Question
Can a single UCS user account be used for RADIUS authentication on multiple devices at the same time, for example for a set of school-owned iPads whose credentials are distributed through an MDM system?
Are there any limitations such as rate limiting or a maximum number of simultaneous sessions per user?
Answer
Yes. A single UCS user account can generally be used to authenticate multiple devices via RADIUS.
UCS does not impose a documented limit on the number of simultaneous RADIUS authentications or sessions for the same user. In particular, there is no default per-user rate limiting or restriction to a single active session.
FreeRADIUS itself supports mechanisms such as Simultaneous-Use, which can restrict the number of concurrent sessions for an account. However, this requires additional accounting and configuration and is not part of the standard UCS RADIUS configuration.
When using one shared account for multiple devices, consider the following:
- All devices use the same identity from the authentication perspective.
- Changing or disabling the account or its password affects all devices using it.
- Individual devices cannot be distinguished based on the RADIUS username alone.
- WLAN controllers or access points may implement their own restrictions on concurrent sessions or repeated authentication attempts. Such limitations need to be checked in the respective WLAN infrastructure.
For managed devices, it is also advisable to use a dedicated RADIUS password instead of the user’s regular domain password. UCS supports service-specific RADIUS passwords, allowing the credentials used for WLAN authentication to be separated from the user’s normal domain credentials.