APPLICABLE PRODUCTS

FlexEdge Devices

Graphite, CR Touchpanels

PRE-REQUISITES

Crimson

- Red Lion DA70 running Crimson 3.2

- FreeRADIUS 3.2.7 on Windows https://sourceforge.net/projects/radiusport/

- DA70 IP Example: 192.168.1.30

- FreeRADIUS Server IP Example: 192.168.1.205

IN THIS ARTICLE

Article will outline the details to setup an authentication server using FreeRADIUS and a FlexEdge DA70.

All Ip address' are examples, yours may be different.

Step 1 - Install FreeRADIUS

Install FreeRADIUS 3.2.7 on Windows.

Start in debug mode: radiusd.exe -X

Step 2 - Configure FreeRadius DA70 Client

Edit: C:\freeradius-3.2.7\etc\raddb\clients.conf

Add:

client DA70

{

ipaddr = 192.168.1.30

secret = da70radius123

shortname = DA70

require_message_authenticator = true

limit_proxy_state = true

virtual_server = default

}

Step 3 - Add FreeRadius Users

These are examples

Edit:

C:\freeradius-3.2.7\etc\raddb\mods-config\files\authorize

Add:

joe Cleartext-Password := "hello"

Reply-Message := "Joe login accepted"

admin Cleartext-Password := "admin123"

Reply-Message := "Admin login accepted"

operator Cleartext-Password := "plant456"

Reply-Message := "Operator login accepted"

engineer Cleartext-Password := "controls789"

Reply-Message := "Engineer login accepted"

Step 4 - Verify FreeRadius Configuration

Ensure the following are enabled in: (Possibly not needed for your configuration)

sites-enabled\default Inside authorize { files pap }

Step 5 - Configure DA70 in Crimson 3.2:

Authentication Method = RADIUS

Server IP = 192.168.1.205

Port = 1812

Shared Secret = da70radius123

*IMPORTANT: The shared secret in Crimson MUST exactly match the secret in clients.conf.*

Step 6 - Test Login

Browse to: DA70 Web Server IP address

Password: hello

Step 7 - Troubleshooting FreeRadius Errors:

No Auth-Type found Possible causes:

- Wrong authorize file

- files module not enabled

- pap module not enabled

- virtual_server not set to default

Error: invalid Message-Authenticator Cause: Shared secret mismatch

Also, you can't have a username in the FreeRadius server and have the same username in the touchpanel

Step 8 - Debugging

Run: radiusd.exe -X (this is FreeRadius debug)

Expected Success Messages:

files: users: Matched entry joe

pap: User authenticated successfully

Sent Access-Accept

*Screen shows successful authentication.*

Keep a local Crimson administrator account in case:

- FreeRADIUS fails

- Network fails

- Shared secret changes

- User database becomes unavailable.