https://www.freeipa.org/page/Using_FreeIPA_and_FreeRadius_as_a_RADIUS_bas...
It says:
PLEASE NOTE that this set-up uses unencrypted passwords between the client and the
authentication server, i.e. password will be trasmitted as CLEAR TEXT, consider this with
respect to your environment.
Would using LDAPS in the RADIUS configuration files fix this ?