radius outpost: invalid message authenticator #17901
Description
Describe the bug
Radius authentication fails with "invalid message authenticator".
To Reproduce
Steps to reproduce the behavior:
- Run radius authentication with eapol_test or with radtest
- See logs of outpost-radius
- See error
Expected behavior
Message validation should work
Logs
authentik-dev-outpost-radius-1 | {"code":"Access-Request","event":"Radius Request","id":0,"ip":"172.16.1.1","level":"info","logger":"authentik.outpost.radius","request":"fa5aa68c-0ca8-44cc-a974-b0528618c1a7","timestamp":"2025-11-02T16:39:30Z"}
authentik-dev-outpost-radius-1 | {"code":"Access-Request","error":"invalid message authenticator","event":"Invalid message authenticator","id":0,"ip":"172.16.1.1","level":"warning","logger":"authentik.outpost.radius","request":"fa5aa68c-0ca8-44cc-a974-b0528618c1a7","timestamp":"2025-11-02T16:39:30Z"}
Version and Deployment (please complete the following information):
- authentik version: gh-version-2025.10 which includes providers/radius: fix inverted message authenticator validation (cherry-pick #17855 to version-2025.10) #17888
- Deployment: docker-compose