RADIUS authentication is retried at secondary server even if first server returned Auth Failure

We have configured two RADIUS servers for failover. Recently, I noticed that failed authentications from the primary are immediately re-asked at the secondary server (which still generates and Auth failure, so the end result is consistent and no harm done).

But there's really no point in asking the failover server if the primary is sure that the auth failed.

Looking at the code, I found a logic error here:

https://github.com/simplesamlphp/simplesamlphp-module-radius/blob/27d7591603dd2665a147857a4f8adcd33eb6d6cf/src/Auth/Source/Radius.php#L167

The code considers the RADIUS query successful only if it returns not-false.

The underlying library returns sth not-false only in case the authentication succeeded. Notably, a failed authentication is as "false" as a protocol error. See the return paths of its function: they are either outright "false" or compare whether the authentication was a success:

https://github.com/dapphp/radius/blob/master/src/Radius.php#L1752

I.e. error conditions and a negative outcome both have the same result; and the calling module in SSP will loop over all configured servers in both cases. Only a positive result breaks out of the loop.

Ideally, a confirmed negative result from the primary authentication server should be taken as-is.

Bắt đầu với src/Auth/Source/Radius.php quanh dòng 167 và kiểm tra các đường dẫn return được tham chiếu trong src/Radius.php của dapphp/radius quanh dòng 1752. Xác nhận cách các lỗi xác thực và lỗi giao thức được biểu diễn, sau đó thêm coverage cho thấy một từ chối primary đã được xác nhận sẽ không được thử lại, trong khi một lỗi vẫn có thể fail over.