I have now found my mistake. I had commented out "updated = return" in the default configuration under authorize in the eap module. The attributes are now passed on an access-accept.