Distech Controls ECLYPSE APEX, Руководство пользователя

Страница: 43 / 171

43 ECLYPSE APEX
CHAPTER 7
Supported RADIUS Server Architectures
A RADIUS server is used to centralize user credentials (controller login username / password) across
all devices. This chapter describes the supported RADIUS server architectures and how to configure a
RADIUS server in EC-Net or in an ECLYPSE controller.
Overview
When network connectivity allows, an EC- gfx Program user can connect directly to an ECLYPSE con-
troller or a user can connect to the ECLYPSE controller through an EC-Net station. No matter the con-
nection method, a user has to authenticate themselves with their user credential (controller login user-
name / password combination). Credentials can be held separately in each device (ECLYPSE con-
troller / EC-Net station), though this is not recommended as maintaining user credentials among multi-
ple devices is more labor intensive.
Under such circumstances, the preferred method is to centralize user credentials in a RADIUS server
on one device or server. When a user connects to an ECLYPSE controller, the ECLYPSE controller
connects to the remote RADIUS server to authenticate the user’s credential. A RADIUS server uses a
challenge/response mechanism to authenticate a user’s login credentials. An unrecognized username
or a valid username with an invalid password receive an ‘access denied’ response. A remote RADIUS
server can be another ECLYPSE controller, Microsoft Windows Domain Active Directory Server, or a
suitably-configured EC-Net / EC-BOS station.
Authentication Fallback
Should the connection to the remote RADIUS server be temporarily lost, ECLYPSE controllers have a
fall back authentication mode: users that have already authenticated themselves with the remote RA-
DIUS server and then the connection to the RADIUS server is lost, these users will still be able to login
to the controller as their successfully authenticated credentials are locally cached.
The user profile cache is updated when the user authenticates themselves while there is a working RADIUS server
connection. For this reason, at a minimum, admin users should log in to each ECLYPSE controller at least once, so
their login can be cached on that controller. Otherwise, if there is a RADIUS server connectivity issue and a user who
has never before connected to the ECLYPSE controller will be locked out from the controller. It is particularly
important for admin user credentials to be cached on each controller as an admin user can change the controller’s
network connection parameters that may be at cause for the loss of connectivity to the RADIUS server.
Supported RADIUS Server Architectures