Both of these will mean you need to update your passwd config to use 'Stripped-User-Name' instead of 'User-Name'.

That was it! Editing "mods-enabled/passwd" to use "Stripped-User-Name" in the place of just "User-Name" did exactly what I needed here. And yes, in this particular circumstance, all I need is that the username and password match regardless of the domain. I do have to say I miss the relative simplicity and utility of the deprecated "unix", whereby users could have different permissions based on their unix group's name, but I don't think I'm going to get very far attempting that with 3.0, especially not when I'm trying to validate information against copies in /etc/radius/passwd /etc/radius/shadow /etc/radius/group instead of the system's own.