Each virtual context can be configured with TACACS separately. when you configure:
shell:Admin=Admin default-domain
and set management ip of Admin context as the device in ACS then a user logging into Admin can do a changeto and get into that context with Admin rights.
But let's say that we have a context named TEST and we want to set up a group of users who only have admin rights for test.
we set up the context to do tacacs (define server aaa authentication etc)
we put the management ip as a new device in ACS
we define the tacacs properties for the group as:
shell:TEST=Admin default-domain
you can use multiple lines in the group or user defining different roles for different contexts, the trick is each context would be configured for tacacs and defined in tacacs as separate devices in ACS.
if you login to the Admin context with Admin rights only Admin context talks to ACS there is no further authentication done when you do a changeto.
when you login directly to contexts those contexts talk to ACS and are identified by IP address of device you added as AAA client IP in network config screen of ACS.
