RADIUS users not inheriting group privileges in Security Analytics

Products

• Security Analytics

Issue/Introduction

Security Analytics supports Radius Authentication.  If a user logs in for the first time to Security Analytics using Radius, as long as Radius Authentication is configured correctly, the user will authenticate and be placed in the correct user group instead of the default.  

Environment

Security Analytics (all versions)

Cause

Security Analytics does not map RADIUS attributes to internal groups.

Resolution

If the user has first logged in using a local account, the only way to convert the user to a Radius user is to first delete the user (Settings > Users and Groups).  Once the local user has been deleted, the Radius user should be able to authenticate using their Radius credentials.  A Radius user will then appear in Settings > Users and Groups.

 

Additional Information

Here is some additional information regarding the logic of Radius and LDAP authentication depending on which one is configured.

If RADIUS is configured but LDAP is not configured.

• SA will authenticate the user via radius.
• SA will automatically create the user, if they do not exist.
• SA will assign the user to the default group.
• After, The admin is allowed to modify what groups the user belongs to.

If RADIUS and LDAP are configured and Use Radius for authentication option is enabled

• SA will authenticate the user via radius (not LDAP).
• SA will automatically create the user, if they do not exist.
• SA will assign the user to the default group.
• SA will also assign the user to groups based on their LDAP groups.
• After, The admin is allowed to modify what groups the user belongs to.

If RADIUS and LDAP are configured and Use Radius for authentication option is disabled

• SA will authenticate the user via radius or LDAP.
• SA will automatically create the user, if they do not exist.
• SA will assign the user to the default group.
• SA will also assign the user to groups based on their LDAP groups.
• After, The admin is allowed to modify what groups the user belongs to.

More information can be found in the documentation here:  Security Analytics Authentication