What EAP type? eg if using PEAP, the client never sends a password, instead its challenge-response which works because the SQL contains a copy of the password so MSCHAP can derive an agreement. Gmhow dies your curl do this? Are you trying thus in the authenticate section and feeding an authorization method?
radiusd -X is your and our friend alan
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

