If the logs say the authentication is valid, then you still need to check the authorization.
You can verify what the radius server is sending to the AP by performing a pcap on the wired port of the AP in question on port 1812 and see if you get an access accept or access reject.