Hello

Our RSA infra was upgraded to address Blast-Radius vulnerability https://www.blastradius.fail/ Since then, radius-proxy enabled users can no longer authenticate against those providers.

I understand the RSA radius servers now require Message-Authenticator attributes to be set which I suppose is the missing piece when freeipa attempts to authenticate.

Anybody have a view on this?

Thanks Angus

From the RSA instructions (lol):

RSA recommends asking your vendors for a fix for the BlastRADIUS vulnerability and applying the client-side fixes immediately. This must be done before applying the RSA patches and enabling the Message-Authenticator configuration.