I had a brainwave this morning. Considering that RadiusClient.getAuthProtocol() supports 'arguments', i.e. using client.getAuthProtocol("eap-ttls:innerProtocol=eap-mschapv2") will return an EAPTTLSAuthenticator object with the inner protocol set to EAP-MSCHAPv2, would it possibly make sense to do away with the enum? 

That way, there's no need for any further fixing, and at the same time it exposes the ability to set the protocol of the inner tunnel in an EAP-TTLS authentication (like the RadiusClient class does at the moment?