Dynamic-VPN user authenticated by Steel-Belted Radius and IP assignment locally with SRX

For Dynamic VPN, some customers want the Radius server to do AAA, and the SRX to assign the IP addresses locally.

Can this work?

Our document ( Dynamic VPN Configuration for Junos 10.4 - Application Note v2.1 ) makes it sound like Radius would have to do both AAA and IP assignment OR the SRX woulld need to do both.

This requirement can be done on SRX as follows:

Below is a lab topology.

   Steel-Belted radius
          |          
srx220--------------------------------dyn-vpn-client pc

srx220, Steel-Belted radius and dyn-vpn-client pc are in the same LAN.
My version of srx220 is 10.4R1.9.

root# show access 
profile remote_access_profile {
    authentication-order radius;
    inactive: client user1 {
        firewall-user {
            password “$ABC123"; ## SECRET-DATA
        }
    }
    address-assignment {
        pool dyn-vpn-address-pool;
    }
    radius-server {
        172.27.186.24 secret “$ABC123"; ## SECRET-DATA
    }
}
address-assignment {
    pool dyn-vpn-address-pool {
        family inet {
            network 10.10.0.0/24;
            xauth-attributes {
                primary-dns 192.168.2.2/32;
                secondary-dns 192.168.2.3/32;
            }
        }
    }
}
firewall-authentication {
    web-authentication {
        default-profile remote_access_profile;
    }
}

2020-02-23: Changed encrypted password to “$ABC123".