When using SmartZone as our wireless controller, we might be tempted to configure an 802.1X WLAN to directly authenticate against an Active Directory server, however, this configuration is not supported.
If a WLAN using 802.1X authentication is required to authenticate against an Active Directory user database, an NPS server is required to function as the RADIUS server. Then, the NPS will contact the AD on behalf of the Authenticator (the SZ for proxy authentication or de AP for non-proxy authentication).
Refer to this KB for additional references from the RUCKUS support portal.
**v/SZ can ONLY authenticate directly with AD for WISPr or WebAuth WLANs
You might be interested to check some of this KBs: