You should also comment out any rlm_realm instances in the authorize section.
The Problem is, suffix is already commented out in authorize section. IMHO the user abc@realm (see 1st try) won't work either.