Which device controls the forwarding of authentication requests for users when connecting to the network using a lightweight access point?

A TACACS server is primarily used for authenticating network device administrators, not typically for end-user wireless access authentication.

A lightweight access point primarily functions as a radio and forwards client authentication requests to its associated Wireless LAN Controller (WLC) for processing.

A RADIUS server performs the actual user authentication, but the Wireless LAN Controller (WLC) is the device that initiates the communication with the RADIUS server, acting as the authenticator in the network access control process.

In a centralized wireless network architecture, the wireless LAN controller (WLC) is the primary device that manages lightweight access points (LWAPs) and processes their authentication requests. When a client connects via an LWAP, the LWAP tunnels the authentication request to its WLC, which then communicates with an external RADIUS server for user authentication.