Hi John,
What server are you using ? Are you using proxy or non proxy settings, in non proxy AP is the authenticator and AP subnet or individual IP needs to be added as radius client.
What does the AAA test say, FYI AAA test is just to check the connection between controller and AAA server using PAP and client Auth uses EAP.
Best Regards
Vineet