DocumentationAPI ReferenceRelease Notes
Documentation

RADIUS | PRA

Suggest Edits

Benefits of RADIUS integration

BeyondTrust Privileged Remote Access integrates with RADIUS servers to provide centralized authentication and strong multi-factor security. This setup supports one-time passcodes, RSA tokens, or other RADIUS-based methods.

  • Authenticate users through existing RADIUS infrastructure.
  • Enhance security with two-factor methods like RSA.
  • Spare users and admins from managing extra credentials.
  • Disable accounts automatically when access is revoked in RADIUS.

How do I access the Security Providers page?

  1. Use a Chromium-based browser to sign in to your Privileged Remote Access URL.
    This URL is provided in the BeyondTrust welcome email and includes your site URL followed by /login.
  2. From the left menu, click Users & Security.
    The Users page opens and displays by default.
  3. At the top of the page, click Security Providers.
    The Security Providers page displays.

Add a security provider

  1. On the Security providers page, click + Add, and then select RADIUS from the list.
    The Add Security Provider page displays.
  2. Configure the security provider following the steps below.
RADIUS fields

  • Name: Create a unique name to help identify this provider.

  • Enabled: If checked, your appliance can search this security provider when a user attempts to log in to the access console or /login. If unchecked, this provider will not be searched.

  • Keep display name synchronized with remote system: These values determine which fields should be used as the user's private and public display names.

  • Authorization settings

    • Only allow the following users: You can choose to allow access only to specified users on your RADIUS server. Enter each username separated by a line break. Once entered, these users will be available from the Add Policy Member dialog when editing group policies on the /login > Users & Security > Group Policies page.

      If you leave this field blank, all users who authenticate against your RADIUS server will be allowed; if you allow all, you must also specify a default group policy.

    • Default group policy: Each user who authenticates against an external server must be a member of at least one group policy in order to authenticate to your appliance, logging into either the /login interface or the access console. You can select a default group policy to apply to all users allowed to authenticate against the configured server.

    • LDAP group lookup If you want users on this security provider to be associated with their groups on a separate LDAP server, choose one or more LDAP group servers to use for group lookup.

  • Connection settings

    • Hostname: Enter the hostname of the server that houses your external directory store.

    • Port: Specify the authentication port for your RADIUS server. This is typically port 1812.

    • Timeout (seconds): Set the length of time to wait for a response from the server. Note that if the response is Response-Accept or Response-Challenge, then RADIUS will wait the entire time specified here before authenticating the account. Therefore, it is encouraged to keep this value as low as reasonably possible given your network settings. An ideal value is 3-5 seconds, with the maximum value at three minutes.

    • Connection method

      • Proxy from appliance through the Connection Agent: If you are using an external directory store in the same LAN as your appliance, the two systems may be able to communicate directly, so leave this option unchecked.

        If the two systems are unable to communicate directly, such as if your external directory server is behind a firewall, you must use a connection agent. Downloading the Win32 connection agent enables your directory server and your appliance to communicate via an SSL-encrypted, outbound connection, with no firewall configuration. The connection agent can be downloaded to either the directory server or a separate server on the same network as your directory server (recommended).

        Check this option, create a Connection Agent Password for use in the connection agent installation process. Then click Download Connection Agent, run the installer, and follow the installation wizard. During installation, you will be prompted to enter the security provider name and the connection agent password you created above.

      ℹ️

      The Proxy from appliance through the Connection Agent option is not available to Privileged Remote Access Cloud customers, as Cloud instances must run the connection agent in order to use an external directory store.

    • Shared secret: Provide a new shared secret so your appliance and your RADIUS server can communicate.

  • Cluster settings (Visible only for clusters)

    • Member selection algorithm: Select the method to search the nodes in this cluster.

      • Top-to-bottom first attempts the server with the highest priority in the cluster. If that server is unavailable or the account is not found, the next highest priority server is attempted. The search moves down through the list of clustered servers until either the account is found or it is determined that the account does not exist on any of the specified and available servers.

      • Round-robin is designed to balance the load between multiple servers. The algorithm chooses at random which server to attempt first. If that server is unavailable or the account is not found, another random server is attempted. The search continues at random through the remaining servers in the cluster until either the account is found or it is determined that the account does not exist on any of the specified and available servers.

    • Retry delay: Set how long to wait after a cluster member becomes unavailable before trying that cluster member again.

  • Test settings

    • Username and password: Enter a username and password for an account that exists on the server you are testing. This account must match the criteria for login specified in the configuration above.
    • Try to obtain user attributes and group memberships if the credentials are accepted If this option is checked, your successful credential test will also attempt to check user attributes and group lookup.
    • Test If your server is properly configured and you have entered a valid test username and password, you will receive a success message. Otherwise, you will see an error message and a log that will help in debugging the problem.

    ℹ️

    For these features to be successfully tested, they must be supported and configured in your security provider.

✅

See Additional setup and tips to:

  • Authenticate using on-time passwords (OTP)
  • Configure for Windows 2000/2003 IAS
  • Troubleshoot the integration

  • Cluster settings (Visible only for clusters)

    • Member selection algorithm: Select the method to search the nodes in this cluster.

      • Top-to-bottom first attempts the server with the highest priority in the cluster. If that server is unavailable or the account is not found, the next highest priority server is attempted. The search moves down through the list of clustered servers until either the account is found or it is determined that the account does not exist on any of the specified and available servers.

      • Round-robin is designed to balance the load between multiple servers. The algorithm chooses at random which server to attempt first. If that server is unavailable or the account is not found, another random server is attempted. The search continues at random through the remaining servers in the cluster until either the account is found or it is determined that the account does not exist on any of the specified and available servers.

    • Retry delay: Set how long to wait after a cluster member becomes unavailable before trying that cluster member again.

  • Test settings

    • Username and password: Enter a username and password for an account that exists on the server you are testing. This account must match the criteria for login specified in the configuration above.
    • Try to obtain user attributes and group memberships if the credentials are accepted If this option is checked, your successful credential test will also attempt to check user attributes and group lookup.
    • Test If your server is properly configured and you have entered a valid test username and password, you will receive a success message. Otherwise, you will see an error message and a log that will help in debugging the problem.

    ℹ️

    For these features to be successfully tested, they must be supported and configured in your security provider.

✅

See Additional setup and tips to:

  • Authenticate using on-time passwords (OTP)
  • Configure for Windows 2000/2003 IAS
  • Troubleshoot the integration
  1. Click Save at the top of the page.

Change priority order of security providers

  1. At the top of the Security providers page, click Change Order.
  2. Drag and drop security providers to set their priority. You can drag and drop servers within a cluster; clusters can be dragged and dropped as a whole.
  3. Click Save Order for prioritization changes to take effect.

Disable a security provider

Disable this security provider connection. This is useful for scheduled maintenance, when you want a server to be offline but not deleted.

  1. On the Security providers page, locate the security provider you want to disable.
  2. Click > Disable.

To re-enable the security provider, click > Enable.

View the log for a security provider

View the status history for a security provider connection.

  1. On the Security providers page, locate the security provider you want to view.
  2. Click > View Log.

Upgrade to cluster

Upgrade a security provider to a security provider cluster. To add more security providers to this cluster, copy an existing node.

  1. On the Security providers page, locate the security provider you want to upgrade to a security provider cluster.
  2. Click > Upgrade to cluster.

Duplicate node

Create a copy of an existing clustered security provider configuration. This will be added as a new node in the same cluster.

  1. On the Security providers page, locate the security provider.
  2. Click > Duplicate node.

Copy a security provider

Create a copy of an existing security provider configuration. This will be added as a top-level security provider and not as part of a cluster.

  1. On the Security providers page, locate the security provider you want to copy.
  2. Click > Copy.

Edit a security provider

ℹ️

If you edit the local security provider and select a default policy that does not have administrator permissions, a warning message appears. Ensure other users have administrator permissions before proceeding.

  1. On the Security providers page, locate the security provider you want to edit from the list.
  2. Click .
    The Edit security provider page displays.
  3. Edit the security provider details. The details available are the same as the Add security provider page details.
  4. Click Save at the top of the page.

Delete a security provider

  1. On the Security providers page, locate the security provider you want to delete.
  2. Click to delete the security provider.

Additional setup and tips

RADIUS: Authenticate using one-time passwords (OTP)

When using the RADIUS security provider, you can choose to use a one-time password (OTP) service provider, such as RSA SecurID. An OTP is a randomized password that is generated by a third-party service provider through a token or some other means and changes within a certain time frame to provide an extra layer of security upon login.

Within your OTP provider's interface, you can configure a prompt to appear asking for credentials on the login screens for the BeyondTrust access console or /login administrative interface. Once configured, users must enter their BeyondTrust username and password and then the OTP into the prompt.

If the OTP is entered correctly, access to the BeyondTrust access console or /login administrative interface will be granted.

However, if the OTP is entered incorrectly, a new prompt will appear asking for the password to be re-entered.

RADIUS: Windows 2000/2003 IAS

Each user who will be authenticating with your IAS server must have remote access permission. The remote access permission can be defined via the Active Directory Users and Computer snap-in. View the properties for the appropriate user. On the tab Dial-in, grant the Allow Access to Remote Access permission.

You can also configure this permission through the remote access policy. Please consult your Windows documentation for the proper steps.

🚧

Important information

The policy must allow for authentication via PAP, as this is the only RADIUS method currently supported by BeyondTrust. Review your IAS policy and ensure this method is supported as a means of authenticating via your appliance.

RADIUS: Troubleshoot the integration
Failed logins

The best way to troubleshoot a failed login is to test the settings in the security provider's configuration page. The section below helps you to understand the messages you may receive.

If testing a username and password from the Security Providers page provides no errors but the user cannot log into BeyondTrust using those same credentials, please check that at least one of the following sets of criteria is met.

  1. The user has been expressly added to an existing group policy.
  2. A default group policy has been set for the security provider configuration created to access the server against which the user is authenticating.
  3. The user is a member of a group that has been expressly added to an existing group policy, and both user authentication and group lookup are configured and linked.
Message 1: Authentication failed
  1. The username and password that you are testing do not match.
  2. Reenter the credentials or attempt another username and password.
Message 10: Server unavailable
  1. Your DNS information may be incorrect. You can test if your DNS server resolves by using the tools on the Support > Utilities page in your BeyondTrust /appliance interface.
  2. You must use the correct shared secret between RADIUS and your appliance.
  3. If a user who can normally authenticate cannot connect, check if the user's hours are restricted on the RADIUS server.
  4. If you are using an IAS server, the user authenticating must have remote access permission enabled.
  5. Authentication via PAP must be enabled. This is the only RADIUS method currently supported by BeyondTrust. Edit your IAS policy and ensure this method is supported as a means of authenticating via the appliance.
Error 6ca and slow logins
  1. A 6ca error is a default response signifying that the appliance has not heard back from the DNS server. It may occur when attempting to log into the access console access console.
  2. If users are experiencing extremely slow logins or are receiving the 6ca error, verify that DNS is configured in your /appliance interface.
Troubleshooting individual providers

When configuring an authentication method tied to group lookup, it is important to configure user authentication first, then group lookup, and finally group policy memberships. When troubleshooting, you will want to work in reverse.

  1. Verify that the group policy is looking up valid data for a given provider and that you do not have any @@@ characters in the Policy Members field.
  2. If a group provider is configured, verify that its connection settings are valid and that its group Search Base DN is in the proper format.
  3. If you want to use group lookup, verify that the security provider is set to look up group memberships of authenticated users.
  4. To test the user provider, set a default policy and see if your users can log in.

Updated 15 days ago

©2003-2025 BeyondTrust Corporation. All Rights Reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust is not a chartered bank or trust company, or depository institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.