IT Glossary
RADIUS authenticates users to Wi-Fi, VPN, and network gear. Learn how the protocol works, why it persists, and the offboarding gap it creates.
August 7, 2026
RADIUS (Remote Authentication Dial-In User Service) is a network protocol that centralizes authentication, authorization, and accounting for users connecting to infrastructure such as Wi-Fi access points, VPN concentrators, and switches. Defined in RFC 2865, it dates from 1997 and still runs in most corporate networks because network hardware speaks it natively.
A company can run entirely on cloud applications and still depend on RADIUS for office Wi-Fi and VPN. That creates an easily missed offboarding path: the leaver's SaaS accounts get handled, while the certificate or credential that opens the corporate network does not. Network access rarely appears on an application offboarding checklist, precisely because it is not an application.
A 200-person company uses 802.1X with RADIUS for Wi-Fi, backed by Active Directory. A contractor's AD account is disabled at the end of the assignment, which correctly kills network access. A second contractor was onboarded with a shared pre-shared key instead, so nothing changes for him. Auditors flag the second case against the ISO 27001 control on access removal. Building the offboarding checklist from a complete application and access inventory rather than from memory is what prevents it, and that inventory is what Corma keeps current.
LDAP is a directory protocol used to store and query identity data. RADIUS is an authentication protocol that usually asks an LDAP directory or Active Directory to validate the credentials it receives.
The original protocol has known weaknesses in its shared secret and MD5 usage. Modern deployments wrap it in EAP-TLS with certificates and run RADIUS over TLS, known as RadSec, instead of plain UDP.
For application access, SAML and OpenID Connect have replaced it entirely. For network access it remains dominant, because switches, access points, and VPN gateways implement it natively.
Yes when RADIUS validates against that directory. It does not when access relies on shared keys, local device accounts, or a certificate that is still valid.
