In the Controller under Configuration> Administration, check to make sure that the administrative login type is PAP. You can do that And/Or key off of the NAS-PORT-TYPE of Virtual to know that this is an administrative login. 6.2 and 6.3 brought the capability that MsChap can be used to Administrative login, instead of just PAP.
EDIT:
You should always key off of the nas-port-type = Virtual, because Captive Portal logins also use PAP as an authentication type.