It's really not too clear as to what you are looking for. When configuring the PIX for AAA, the server is placed on the DMZ and all incoming and outgoing traffic can be authenticated using this server by configuring the necessary AAA commands on the PIX. You don't need to explicily permit the authencation traffic between the interfaces.
If what you are trying to do is to authenticate inside users (who are accessing resources on the inside) using the server on the DMZ, that would not be a good idea. To authenticate inside users for resources on the inside interfaces, I would go in for a server placed on the inside itself.
