Things that I would check for this case
client is able to associate and get an IP address
the correct roles are being assigned
are you able to get past captive-portal
Can you ping the radius server from controller
do you test the authentication by providing username/password in controller?