Looks like a UI glitch (it's correct in LDAP) but when configuring users to use RADIUS auth, these settings to not show as enabed/selected on other ipa servers. Steps to repeat: 1) add user 2) disable all password options, select only RADIUS 3) configure proxy username and server. 4) check replica. Thanks - Jake