AP authenticates users without radius server

[cchathuranga88]

I have AIR-AP1242AG-S-K9 standalone access point. It has radius server group configured but no radius server configured under the group. But still it authenticates the users. I'm trying to figure out how it authenticate the users. Below is the output,

Cisco-floor1-ap07#show radius server-group all
Sever group rad_eap
Sharecount = 1 sg_unconfigured = FALSE
Type = standard Memlocks = 1

- Is there any bug in the model of access point which make access point not to show the radius server in config?

- If there is no radius server under radius group, users authenticate automatically?

[patoberli]

Can you share your SSID configuration?

Please note, this is an extremely old AP and a lot of documentation doesn't anymore exist for this device.

[Rich R]

Like @patoberli said this AP is long past end of support and will be running VERY old IOS.
Bugs are very likely - but without seeing your full config showing SSID, aaa and radius config from the AP it's impossible to comment.  On older IOS radius config sometimes wasn't even in a group so you might be using standalone radius config.
You can easily check on your radius server whether they are getting authenticated by the server and you could run a debug on the AP too.
Some versions of IOS did have a bug where they didn't display aaa config correctly in show commands.

[cchathuranga88]

@patoberli @Rich R Thanks for your inputs. Below is the radius and aa config of the access point. Pls note I cannot see "radius server host xxxx " command in the configuration. 

aaa group server radius radius_eap
!
aaa authentication login default group tacacs+ local
aaa authentication login Console line
aaa authentication login eap_method group radius_eap
aaa authorization config-commands
aaa authorization exec default group tacacs+
aaa authorization commands 0 default group tacacs+ none
aaa authorization commands 1 default group tacacs+ none
aaa authorization commands 15 default group tacacs+ none
aaa accounting commands 15 default start-stop group tacacs+
aaa cache profile admin_cache
!
aaa session-id common
!
dot11 ssid lobby11
authentication open eap eap_method
authentication network-eap eap_method
mobility network-id 700
!
dot11 ssid lobby12
authentication open eap eap_method
authentication network-eap eap_method
mobility network-id 800

[Rich R]

Nothing in your config starting with "radius-server host"?
What does "show aaa servers" show?
Agreed that config doesn't look right though.
Did you run debug?
Did you check on the radius server?

[cchathuranga88]

Nothing in your config starting with "radius-server host"? Unfortunately no
What does "show aaa servers" show? No results
Did you run debug?  yes. user associated and dissociated logs. no IP address.
Did you check on the radius server? we have many auth servers in our evnvironments 

[Rich R]

Well then it doesn't sound like your users are being authenticated by radius and the debug should have told you how they are being authenticated.