Without knowing exacly how your supplicant is configured or seeing the error in access tracker, it is difficult to know what is going on.
However, perhaps you could try to strip out the domain portion of the username. In your service on the Authentication tab, do this.