PI 3.14 eand freeradius: limit for 50 token?

mengainside · October 20, 2026, 8:26am

I updated PI from 3.13.3 to 3.14. Now, the same user is sometimes able to log in and sometimes not. I’ve tried some debugging (including with the help of AI), and I’ve been told that version 3.14 introduces a limit on requests coming from FreeRADIUS. Is this correct? I haven’t been able to find any documentation on it.

cornelinux · October 20, 2026, 12:17pm

Thank you for bringing this to attention.

You are right, version 3.14 checks subscription, when the privacyIDEA FreeRADIUS plugin sends auth requests to the privacyIDEA server. This was not our intention.

As you might have noticed, we introduced an extensive Dashboard in 3.14.
It also containes a subscription-view or component-view.

This can help you to

understand what privacyIDEA is capable of and
which components you actually have connected and
yes, if you have a subscription for these components.

Anyways, these code changes unintentionally added the subscription check for the FreeRADIUS plugin. It will be fixed in version 3.14.1.

You can either contact NetKnights for a demo subscription or the probably easiest way to cope with that is, tell the FreeRADIUS-Plugin, that it is not a FreeRADIUS.
Since the subscription is checked against the user-agent name you can find this code line in your radius plugin:

github.com/privacyidea/FreeRADIUS

privacyidea_radius.pm

master


      
          }
          else {
              &radiusd::radlog( Info, "urlparam $_ \n" ) for ( keys %params );
          }
          
          my $ua = LWP::UserAgent->new();
          $ua->env_proxy;
          $ua->timeout($timeout);
          &radiusd::radlog( Info, "Request timeout: $timeout " );
          # Set the user-agent to be fetched in privacyIDEA Client Application Type
          $ua->agent("FreeRADIUS");
          if ($check_ssl == false) {
              try {
                  # This is only availble with LWP version 6
                  &radiusd::radlog( Info, "Not verifying SSL certificate!" );
                  $ua->ssl_opts( verify_hostname => 0, SSL_verify_mode => 0x00 );
              } catch {
                  &radiusd::radlog( Error, "ssl_opts only supported with LWP 6. error: $_" );
              }
          } else {
              try {

and e.g. change it to

$ua->agent("Revert-me-back-to-FreeRADIUS"):

Please note, that in this case the policy conditions for the user-agent “FreeRADIUS” will not work anymore…
…in case you have such policies.

Please note on top: When updating to 3.14.1 I strongly recommend to revert this change back.

I hope this helps.
Kind regards
Cornelius