What is RADIUS Authentication and How Does It Work?

### What is RADIUS Authentication and How Does It Work? — Purple Technical Briefing **[INTRO — 1 minute]** Welcome to the Purple Technical Briefing. I'm your host, and in the next ten minutes, we're going to demystify one of the most critical technologies for enterprise network security: RADIUS authentication. If you're an IT manager, a network architect, or a CTO responsible for WiFi at a large venue — a hotel, a retail chain, a stadium, or a conference centre — this briefing is specifically for you. We'll cut through the jargon, explain the architecture clearly, and give you the practical insights you need to make informed decisions this quarter. Let's start with the big picture. Why does any of this matter? If you're still running your guest or staff WiFi on a single shared password — a Pre-Shared Key, or PSK — you are operating with a significant and growing security risk. That password gets shared, written on receipts, photographed on whiteboards, and forwarded via messaging apps. Once it's out, you have no visibility into who is on your network, no ability to revoke access for a single user without disrupting everyone, and no audit trail if something goes wrong. For organisations subject to PCI DSS, GDPR, or HIPAA, this isn't just a technical problem. It's a compliance liability. RADIUS is the solution that the industry has converged on to address this. So let's understand exactly what it is and how it works. **[TECHNICAL DEEP-DIVE — 5 minutes]** RADIUS stands for Remote Authentication Dial-In User Service. The name is a historical artefact from the early days of dial-up internet, but the protocol has evolved significantly and remains the backbone of enterprise network access control today. At its core, RADIUS is a centralised server-based system that manages network access using a framework called AAA — Authentication, Authorization, and Accounting. These three pillars are the foundation of everything we'll discuss today. Authentication is the first pillar: verifying who someone is. Authorization is the second: determining what they're allowed to do. And Accounting is the third: recording what they actually did. Let's explore each one. Authentication. When a user tries to connect to a WiFi network secured with WPA2-Enterprise or WPA3-Enterprise, their device — which we call the Supplicant — sends a connection request to the wireless access point. The access point, which we call the Authenticator, does not make the authentication decision itself. It acts as a relay, forwarding the request to the RADIUS server. The RADIUS server then validates the user's identity against a configured identity source. This could be Microsoft Active Directory, Azure Active Directory, Google Workspace, Okta, or a local user database. The identity source is the single source of truth for who is allowed on your network. The RADIUS server can validate identity in several ways. The most common in enterprise environments are credential-based methods, where the user provides a username and password, and certificate-based methods, where the user's device presents a digital certificate. We'll talk about the security implications of each shortly. Authorization. Once the user is authenticated, the RADIUS server doesn't just say yes and step aside. It also tells the access point exactly what to do with this user. It sends back a set of attributes — instructions, essentially — that define the user's network experience. The most important of these is typically the VLAN assignment. The RADIUS server might say: this user is a member of the corporate staff group, assign them to VLAN ten, which has access to internal file servers and printers. Or: this user is a guest, assign them to VLAN twenty, which only has internet access and is completely isolated from the corporate network. This dynamic VLAN assignment is one of the most powerful features of RADIUS, and it's the mechanism that enables proper network segmentation. Accounting. The third pillar is often overlooked, but it's critically important for compliance and operations. As a user's session progresses, the RADIUS server logs key information: the time they connected, the time they disconnected, the total session duration, the amount of data they transferred, and the MAC address of their device. This creates a detailed audit trail for every connection on your network. Under PCI DSS 4.0, this kind of logging is not optional — it's a hard requirement. And in the event of a security incident, these logs are invaluable for forensic investigation. Now, let's talk about the technical standard that makes all of this work: IEEE 802.1X. 802.1X is the standard that defines port-based network access control. It's the protocol that allows an access point to block all network traffic from a device until the RADIUS server has confirmed that the device is authorised. The communication between the user's device and the access point uses a protocol called EAP — the Extensible Authentication Protocol. EAP is essentially a framework that supports multiple authentication methods. The three most common EAP methods in enterprise WiFi are: PEAP, which stands for Protected Extensible Authentication Protocol; EAP-TTLS; and EAP-TLS. PEAP and EAP-TTLS are credential-based methods. They create an encrypted tunnel between the device and the RADIUS server, and then the user's username and password are verified inside that tunnel. They're relatively easy to deploy and work well in environments where you're not yet ready for a full certificate infrastructure. EAP-TLS is the gold standard. It's certificate-based, meaning both the server and the client device present digital certificates to authenticate each other. There is no password involved at all. This completely eliminates the risk of credential theft, phishing attacks, and man-in-the-middle attacks. For corporate devices, EAP-TLS is the authentication method you should be working towards. **[IMPLEMENTATION AND PITFALLS — 2 minutes]** So how do you actually deploy all of this? Let me walk you through the key steps. First, choose your RADIUS server. You can deploy an on-premise server — Microsoft's Network Policy Server is a common choice in Windows environments — or use a cloud-based RADIUS service. Cloud RADIUS platforms, like the one offered by Purple, provide a fully managed, highly available infrastructure without the operational overhead. For multi-site organisations, the cloud approach is almost always the right choice. Second, integrate your identity source. Connect your RADIUS server to your organisation's identity directory. Most modern cloud RADIUS platforms support direct integration with Azure AD, Google Workspace, and Okta. Third, configure your network hardware. Create a new SSID configured for WPA2-Enterprise or WPA3-Enterprise and point it at your RADIUS server. You'll also configure a shared secret — a password that encrypts the communication between the access point and the RADIUS server. This shared secret must match exactly on both sides. A mismatch here is one of the most common causes of authentication failures during initial deployment. Fourth, define your authorisation policies. Map user groups to network policies — staff get full access on VLAN ten, guests get internet-only access on VLAN twenty. Fifth, onboard your users. For corporate staff, deploy WiFi profiles via your MDM platform. For guests, use a captive portal. Purple's platform automates the guest onboarding flow, supporting social media logins, registration forms, and voucher codes. **[RAPID-FIRE Q&A — 1 minute]** Let's do a rapid-fire Q and A on the questions we hear most often. First: What's the difference between RADIUS and a captive portal? A captive portal is the login page guests see when they connect. It works with RADIUS. The portal is the user interface; RADIUS is the back-end engine. Second: Can I use RADIUS for wired networks? Absolutely. The 802.1X standard applies equally to wired Ethernet and wireless networks. Third: Is RADIUS difficult to set up? It has a reputation for complexity, but modern cloud platforms have changed this dramatically. With a managed service like Purple, you can get a production-ready RADIUS deployment up and running quickly. **[SUMMARY AND NEXT STEPS — 1 minute]** To summarise: RADIUS is the centralised protocol that powers enterprise WiFi security. It implements the AAA framework to give you granular control over who can access your network, what they can do, and a complete audit trail of their activity. For venue operators, hoteliers, retailers, and public-sector organisations, deploying RADIUS is the foundational step in building a secure, compliant, and professionally managed WiFi infrastructure. Your next step is clear: if you're still running on pre-shared keys, start planning your migration today. Review your current hardware for WPA3-Enterprise support, assess your identity directory integration options, and explore a cloud RADIUS platform that can scale with your organisation. That's all we have time for on this Purple Technical Briefing. Thanks for listening. To learn more about how Purple can help you deploy secure, intelligent WiFi across your venues, visit us at purple dot ai. Until next time, stay secure.