VLANs allowed vs VLANs active — cannot pull DHCP over WiFi

I found the answer here:

http://forums-archive.ruckuswireless.com/forums/8/topics/1278

NPS does not return AD group memberships back to the ZoneDirector without setting a vendor-specific attribute on NPS. A role has to be configured for each group on the ZoneDirector and a network policy has to be configured for each group on NPS.

This seems rather redundant as I've already got authorization and vlan assignment happening on NPS, why would the ZoneDirector also require a role to authorize access to the specified WLAN? Oh well at least it works now.

What is the configuration of the physical interfaces?
Do you use auto-configure under your interfaces where you are receiving users requests ?

EXAMPLE:

Interface configuration:

xe-1/0/0 {
    description Subscribers;
    hierarchical-scheduler maximum-hierarchy-levels 2;
    flexible-vlan-tagging;
    auto-configure {
        stacked-vlan-ranges {
            dynamic-profile StakedVlan {
                accept [ dhcp-v4 dhcp-v6 pppoe ];
                ranges {
                    1600-1999,1600-1999;
                }
            }
            access-profile SubscriberDhcp;
        }
        vlan-ranges {
            dynamic-profile SingleVlan {
                accept [ dhcp-v4 dhcp-v6 pppoe ];
                ranges {
                    1600-1999;
                }
            }
            access-profile SubscriberDhcp;
        }
        remove-when-no-subscribers;
    }
    mtu 9192;
    encapsulation flexible-ethernet-services;
}

Dynamic profiles:

StakedVlan {
    routing-instances {
        "$junos-routing-instance" {
            interface "$junos-interface-name";
        }
    }
    interfaces {
        demux0 {
            unit "$junos-interface-unit" {
                demux-source inet;
                proxy-arp;
                vlan-tags outer "$junos-stacked-vlan-id" inner "$junos-vlan-id";
                demux-options {
                    underlying-interface "$junos-interface-ifd-name";
                }
                family inet {
                    unnumbered-address "$junos-loopback-interface";
                }
            }
        }
    }
}                                       
SingleVlan {                           
    routing-instances {                 
        "$junos-routing-instance" {     
            interface "$junos-interface-name";
        }                               
    }                                   
    interfaces {                        
        demux0 {                        
            unit "$junos-interface-unit" {
                demux-source inet;      
                proxy-arp;              
                vlan-id "$junos-vlan-id";
                demux-options {         
                    underlying-interface "$junos-interface-ifd-name";
                }                       
                family inet {           
                    unnumbered-address "$junos-loopback-interface";
                }                       
            }                           
        }                               
    }                                   
}