configurable radius max retries and cascade-on-timeout suppression#10271
Closed
fmotzet wants to merge 1 commit into
Closed
configurable radius max retries and cascade-on-timeout suppression#10271fmotzet wants to merge 1 commit into
fmotzet wants to merge 1 commit into
Conversation
AdSchellevis
requested changes
May 7, 2026
| $pconfig['radius_acct_port'] = $a_server[$id]['radius_acct_port'] ?? ''; | ||
| $pconfig['radius_secret'] = $a_server[$id]['radius_secret'] ?? ''; | ||
| $pconfig['radius_timeout'] = $a_server[$id]['radius_timeout'] ?? ''; | ||
| $pconfig['radius_max_retries'] = $a_server[$id]['radius_max_retries'] ?? ''; |
Member
There was a problem hiding this comment.
we better move these to the Radius class, same as 95483e5
| } | ||
| return true; | ||
| } | ||
| // only cascade on a decisive answer; an upstream that didn't |
Member
There was a problem hiding this comment.
Let's focus on retries and don't try to complicate the flow further than needed, if you only need a single upstream authenticator, just configure a single one.
Member
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Important notices
Before you submit a pull request, we ask you kindly to acknowledge the following:
If AI was used, please disclose:
Describe the problem
OpenVPN authentication via RADIUS to an interactive-2FA backend (e.g. NPS with the NPS Extension for Microsoft Entra MFA) is unreliable due to a hardcoded retry count and an unconditional authmode-cascade on timeout. See #10270 for the full reproduction.
Describe the proposed solution
radius_max_retries. Plumb the existing libradiusmax_triesparameter throughOPNsense\Auth\Radius::setProperties()and add a UI field next to "Authentication Timeout" under System → Access → Servers. The class default of 3 is preserved when the field is empty, so existing installs are unchanged. Users with interactive 2FA backends can raise it (e.g. 20) to extend the per-attempt approval window without touching any other knob.authenticate()call on theRadiusclass as one ofaccept,reject,timeout, orerror, exposed via a newgetLastResult()method. Inuser_pass_verify.php, after a failed authenticate(),breakout of the authmode foreach if the previous source returnedtimeout. Explicit Access-Reject still cascades, preserving multi-source flows such as a Local-then-RADIUS fall-through, or routing users that exist in NPS2 but not NPS1.The cascade-suppression check uses
method_exists()against the authenticator, so non-Radius authenticators behaviour is unchanged.Validation against the live setup described in the issue: with
radius_max_retries=20, an end-to-end MFA approval that previously failed at ~9 seconds now succeeds at any point within the configured budget; with the cascade-suppression in place a no-tap negative test produces 20 retransmits to the primary NPS, zero traffic to the secondary, and a single-lineauth source '...' did not respond ... skipping remaining auth sourceswarning in syslog.Compared to the log in the related Issue, only sends request to the IP of one NPS Server. Still timeouts after reaching
radius_max_retries=20Related issue
#10270