Just to confirm the source address here 10.x.x.x is an ip addres configured on an interface of the ex switch.
10.x.x.28 source-address 10.x.x.x
Try running the following tests:
ping 10.x.x.28 source 10.x.x.x
traceroute 10.x.x.28 source 10.x.x.x
If these do not work you need to troubleshoot routing from the EX up to the auth server until the path is working.
If they do work, then the next step is to install wireshark and do a packet capture on the auth server during the failed login attempts. We need to confirm the packets are arriving and what the content of the communications is.