Passwordless FIDO works on the web portal, but the legacy VPN RADIUS mapping still expects the old UPN suffix and rejects the session

Modern identity succeeds in one channel while a legacy gateway still anchors on an outdated identity format.