802.1x peeve

So, I'm trying to set up 802.1x, using MSFT's IAS server to do authentication against windows domain accounts. Seems straightforward enough.

I've set the switch up, which was pretty simple. The IAS server is being difficult, however. I've got it set to not send any extra VSA (vendor-specific attributes), but it's sending several along with the authentication approval that seem to make the switch choke. I've got a ticket open with MSFT about it.

It's not clear to me what's going on, here. I'll post again when I figure out more.