What are the roles of 802.1X authenticators and authentication servers?

In the IEEE 802.1X framework, the roles are clearly defined based on the RADIUS protocol. The authenticator (e.g., an Aruba AP or switch) acts as a network access point and functions as a RADIUS client. It relays authentication messages between the supplicant (end-user device) and the authentication server. The authentication server (e.g., Aruba ClearPass) functions as the RADIUS server. It processes the authentication request, checks credentials against its database, evaluates policies, and sends an access decision (Accept/Reject) back to the authenticator.

A. The authentication server stores both the user account database and the access policies that determine authorization levels. The authenticator does not store these.
B. The authenticator passes EAP messages from the supplicant to the authentication server by encapsulating them within the RADIUS protocol. Both protocols are used in the exchange.
D. The authentication server makes the final access decision. The authenticator's role is to enforce that decision by either granting or denying the supplicant access to the network.

1. Aruba. (2021). ArubaOS 8.10.0.0 User Guide. Chapter "802.1X Authentication". This chapter describes the relationship between the authenticator (AP/Controller) and the authentication server (RADIUS server), defining the authenticator as the RADIUS client.

2. IEEE. (2010). IEEE Std 802.1X-2010 - IEEE Standard for Local and metropolitan area networks--Port-Based Network Access Control. Section 5.1, "Architectural overview". This standard defines the authenticator as the entity that facilitates authentication, and the authentication server as the entity that provides the authentication service. The interaction is typically RADIUS.

3. Aruba. (2020). ClearPass Policy Manager 6.9 User Guide. Chapter 1, "Introduction". The guide describes ClearPass as an authentication server (RADIUS server) that receives requests from network access devices (RADIUS clients/authenticators) like switches and APs.