Routing is an important consideration in setting up this. Yes, if you do not select a source addres you will make the request from the root routing instance using the mgmt address if enabled and up or a loopback address if not.
Setting the source address then allows you to control what interface the request is set from and by extension then the routing instance that the interface belongs to.
I would do a packet capture on the auth server during a login attempt to verify that the request is reaching the server.
You can also do a treace route and ping setting the source address to be the same as the one you use in the auth configuration to verify the path from the switch to the auth server. Also double check any firewalls in that path permit the traffic.
ping 10.*.*.28 source10.0.0.1