On users file, last line say: # On no match, the user is denied access.
In the default config, that's correct, since the default config says:
authorize {
preprocess
chap
mschap
suffix
eap
files
pap
}
i.e. "files" is the only data source and no match means no password.
You are not running the default config. You've added the "ldap" module,
so even though "files" doesn't match, "ldap" does.