RADIUS with LDAP/LDAPS backend authentication
Using a backend authentication store such as LDAP is useful for many reasons. Since this is usually using the same authentication store as regular logins, this gives us several advantages, detailed as follows:
- Group membership in LDAP can be used to control access to critical accesses (such as administrative access).
- Passwords are the same for RADIUS access as for standard logins, making them easier to remember.
- Passwords and password changes are under the user's control.
- Credentials maintenance is in one central location in the event of a user changing groups. In particular, if a user leaves the organization, their account is disabled in RADIUS as soon as it is disabled in LDAP.
The downside of this method is simple: users are horrible at picking good passwords. This is why, especially for any interfaces that face the public internet, it's recommended to use MFA (we'll cover this later in this...