This article explains about Radius server remote authentication and it also explains how to identify the issue and rectify the configuration if you see the below logs.
RADIUS authentication is failing, even though the device is receiving a Radius ACCESS-ACCEPT from the server.
The following error is observed in the logs:
PAM_USER_LOCK_USER_AUTHEN_NO_LOGIN: User remote is authenticated successfully but no logical login-id configured.
error: PAM: User account has expired for [email protected] from x.x.x.x
This error means that the user you're authenticating with has been granted access from the Radius Server's perspective, nonetheless, either the user's template does not exist on the device or the user 'remote' is missing from the configuration. Also, If 'remote' user is misspelled this will trigger the same error.The network device can map RADIUS-authenticated users to a locally defined user account or user template account, which determines authorization. By default, Junos OS assigns RADIUS-authenticated users to the user template account remote, if configured, when:
remote
The authenticated user does not have a user account configured on the local device.
The RADIUS server either does not assign the user to a local user template, or the template that the server assigns is not configured on the local device.
The RADIUS server can assign an authenticated user to a different user template to grant different administrative permissions to that user. The user retains the same login name in the CLI but inherits the login class, access privileges, and effective user ID from the assigned template.
If the RADIUS-authenticated user does not map to any locally defined user account or user template, and the remote template is not configured, then authentication fails.
To overcome the issue, make sure remote user exists. Sample configuration:
# set system login user remote class super-user
or
# set system login user remote uid xxxx class super-user
2024-02-16 : Article Created
2025-01-09 : Title and category updated.