When I set the Radius account to connect to PDU, su/administrator works fine.  

But when I set su/user account and try to login, the Radius server logs show successful connection and access granted, while the PDU logs show access denied.

What's the reason?

The concept of the LDAP and Radius communication is to use an account as a reference.  

To use user account, the su/user means the user account that you create.  

For example, if you create an user account called abcde, the entry you have to set is su/abcde.  

All the AD account in that group will follow the authority of the reference account.

For example, customer could set 2 accounts.  Account A has the access of outlet 1~4, account B has the access of outlet 5~8.

The AD group 1 map with account A, so the accounts in AD group 1 has the same authority of account A.

The AD group 2 map with account B, the accounts in AD group 2 has the same authority of account B.