goauthentik / goauthentik/authentik
RADIUS as a Federated Identity Provider
- Dominant language
- Python
- Stars
- 25.6k
- Forks
- 2k
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 644
Description
**Is your feature request related to a problem? Please describe.**
We need the ability to authenticate users using RADIUS using an external authentication system (RSA Authentication Manager). This system only offers authentication services via RADIUS. It does not offer authentication services via any other methods.
**Describe the solution you'd like**
We would like to be able to forward authentication requests for specific applications over to external RADIUS servers. I'm told this is often referred to as an Authentik "Federated Identity Provider"
**Describe alternatives you've considered**
There are no alternatives. If Authentik cant do this, we wont be able to utilize this software to fulfill our requirements.
**Additional context**
Our workflow would look something like this:
user accesses the resources via DNS name: www.resource.com
DNS record points at the NGINX Reverse proxy.
NGINX forwards the request over to Authentik.
Authentik determines that the resource being accessed requires authentication.
Authentik redirects the user session to an authentik authentication page.
User enters in their RSA username and RSA pin+tokencode.
User submits authentication information to Authentik.
Authentik then forwards the RSA username + rsa pin /passcode to the RSA server via RADIUS.
RSA successfully authenticates the user sending an response back to Authentik.
Authentik redirects the user session over to the appropriate resource.
Contributor guide
Assessment
This issue has not been assessed yet.