17.5. What are possible migration strategies?

You are already running an OTP system like OneSpan (formerly Vasco), RSA SecurID or Thales (formerly SafeNet) (alphabetical order) but you would like to migrate to privacyIDEA.

There are different migration strategies using the RADIUS token or the RADIUS passthru policy.

17.5.1. RADIUS token migration strategy

Configure your application like your VPN to authenticate against the privacyIDEA RADIUS server and not against the old deprecated RADIUS server.

Now, you can enroll a RADIUS token for each user, who is supposed to log in to this application. Configure the RADIUS token for each user so that the RADIUS request is forwarded to the old RADIUS server.

Now you can start to enroll tokens for the users within privacyIDEA. After enrolling a new token in privacyIDEA you can delete the RADIUS token for this user.

When all RADIUS tokens are deleted, you can switch off the old RADIUS server.

For strategies on enrolling tokens see What are possible rollout strategies?.

17.5.2. RADIUS PASSTHRU policy migration strategy

Configure your application like your VPN to authenticate against the privacyIDEA RADIUS server and not against the old deprecated RADIUS server.

The passthru policy can point to a system-wide RADIUS server. Define a system-wide RADIUS server and create an authentication policy with the passthru action pointing to this RADIUS server. This means that - as long as the user trying to authenticate has no token assigned - all authentication requests with this very username and the password are forwarded to this RADIUS server.

As soon as you enroll a new token for this user in privacyIDEA the user will authenticate with this very token within privacyIDEA and his authentication request will not be forwarded anymore.

The passthru policy sends one RADIUS request and accepts the authentication only if the RADIUS server answers with Access-Accept. If the old system answers with a challenge (Access-Challenge), e.g. to ask for the next token code, the authentication fails. For such systems use the RADIUS token migration strategy above: with the PIN checked by the RADIUS server (the default), the RADIUS token passes the challenge of the old server on to the user if the authentication policy challenge_response includes the token type radius.

As soon as all users have a new token within privacyIDEA, you can switch off the old RADIUS server.

For strategies on enrolling tokens see What are possible rollout strategies?.