You can troubleshoot MessageAuthenticatorAttribute issues by using the IDP catalina logs.
When the MessageAuthenticatorAttribute value is set to true, the log file contains the following text:
For Message-Authenticator(80) Property: MessageAuthenticatorAttribute = true
Message-Authenticator(80) with length: <length_for_attribute_value> is created
NOTE:This property is required only when the Message Authenticator is enabled on the Radius Server.
When any issue occurs in calculating the Message-Authenticator (80) value, the log file contains the following error message:
Exception in calculating Message-Authenticator payload: <Error String>