You are absolutely right this was an oversight on our side and yes we've decided, as per the same analytical process you went through, to use SQL as a back end instead of files and ditching pfsense altogether.

The appeal of pfsense was that it is almost he only decent GUI to manage freeradius which help with the adoption internally.

Thanks a lot for the reply.

However the cheer amount of user causes the browser to crash, so would it be possible to implement pagination on the user page ?

I've been looking myself for another solution.
I'm using a MySQL (Mariadb) server for the Freeradius "scratch pad" needs.
What about not using a flat text file use by Freeradius, created by pfSense upon FreeRadius start (actually User page config page save) : /usr/local/etc/raddb/mods-config/files/authorize, but a database table, already present on the MySQL server ?
This way I can use phpmyadmin or whatever other tool to add/modify/remove my captive portal user list, just by modifying the user table.

For a "15000" users list this would be far easier to handle them in a database. Your pfSense config.xml is probably also rather big.

Have a loo at the 'master' config file : /usr/local/etc/raddb/sites-enabled/default - the keyword 'files' in the section "authorize" handles the authorization.
The database (in my case) is only used for accounting, like start (and eventually stop) and quantity of byres send/received.

I did some testing.
Condition : you should already have a MySQL database set up for FreeRadius usage.

First : some reading : guide/SQL HOWTO
Looks like it isn't rocket science after all

I've created these 3 test users, to be entered in the "radcheck" table :

Some more settings in the "radreply" table :

Let's fool around with the /usr/local/etc/raddb/sites-enabled/default file. For this to happen, edit
/usr/local/pkg/freeradius.inc
and lcoate all the "files" :
line 1466 - change it for :

## files

Same for line 1577 and line 2202.
Maybe also 2268, but I didn't change that one.
=>That's all that needs to be done, you'll see.

Now, goto Services > FreeRADIUS > Settings and without changing anything, save the settings.
I've checked my /usr/local/etc/raddb/sites-enabled/default - the "files" were now prepended with "##".
I stopped FreeRadius on the pfSense dashboard ( ! )
I opened a SSH access, and fired freeradius up manually, in debug mode

radiusd -X

In another SSH session, I used "radtest"

Take note : radius is my secret key as set up in the pfSense Freeradius settings. Please don't tell no one.

[23.09.1-RELEASE][root@pfSense.bhf.net]/root: radtest 001 climat 192.168.2.1 10 radius
Sent Access-Request Id 169 from 0.0.0.0:10f8 to 192.168.2.1:1812 length 73
        User-Name = "001"
        User-Password = "climat"
        NAS-IP-Address = 192.168.1.1
        NAS-Port = 10
        Message-Authenticator = 0x00
        Cleartext-Password = "climat"
Received Access-Accept Id 169 from 192.168.2.1:714 to 192.168.2.1:4344 length 26
        Acct-Interim-Interval = 600

I got a "Access-Accept" back !! and the returned value for "Acct-Interim-Interval" is "600".

This is very promising !

More changes are most probably needed, as it can't be that easy...

My FreeRadius wasn't using the pfSense GUI FreeRadius Users page !

I'm still wondering how you managed to maintain 15000 users on that pfSense Freeradius Users page.
That must have been painful. You never wondered how to make the system work for you ?? Or work for you with more comfort ? These things are machines, you need to tell them what to do for you

https://redmine.pfsense.org/