I have the switch configured as an access link from switch to RAP (all users on the same VLAN), the AAA profile is configured under the L2 Authentication section in Managed Network, and assigned to the AP Profile Wired Port AAA profile
AAA profile has initial role of logon, and 802.1x authentication default role as authenticated?