36 ECLYPSE Connected Thermostat (ECY-STAT)
CHAPTER 7
Supported RADIUS Server Architectures
A RADIUS server is used to centralize user credentials (controller login username / password) across
all devices. This chapter describes the supported RADIUS server architectures and how to configure a
RADIUS server in EC-Net or in an ECY-STAT.
Overview
When network connectivity allows, an EC-
gfx
Program user can connect directly to an ECY-STAT or a
user can connect to the ECY-STAT through an EC-Net station. No matter the connection method, a
user has to authenticate themselves with their user credential (controller login username / password
combination). Credentials can be held separately in each device (ECY-STAT / EC-Net station), though
this is not recommended as maintaining user credentials among multiple devices is more labor inten-
sive.
Under such circumstances, the preferred method is to centralize user credentials in a RADIUS server
on one device or server. When a user connects to an ECY-STAT, the ECY-STAT connects to the re-
mote RADIUS server to authenticate the user’s credential. A RADIUS server uses a challenge/re-
sponse mechanism to authenticate a user’s login credentials. An unrecognized username or a valid
username with an invalid password receive an ‘access denied’ response. A remote RADIUS server
can be another ECY-STAT, Microsoft Windows Domain Active Directory Server, or a suitably-config-
ured EC-Net / EC-BOS station.
Authentication Fallback
Should the connection to the remote RADIUS server be temporarily lost, ECY-STAT controllers have a
fall back authentication mode: users that have already authenticated themselves with the remote RA-
DIUS server and then the connection to the RADIUS server is lost, these users will still be able to login
to the ECY-STAT as their successfully authenticated credentials are locally cached.
The user profile cache is updated when the user authenticates themselves while there is a working RADIUS server
connection. For this reason, at a minimum, admin users should log in to each ECY-STAT at least once, so their login
can be cached on that controller. Otherwise, if there is a RADIUS server connectivity issue and a user who has never
before connected to the ECY-STAT will be locked out from the controller. It is particularly important for admin user
credentials to be cached on each controller as an admin user can change the controller’s network connection
parameters that may be at cause for the loss of connectivity to the RADIUS server.
Supported RADIUS Server Architectures
To Next Page
Loading...
Need help?
General
