ACS Location Access Control.. How?

[rfc791-cisco]

I have spent 2 days trying to get Location based access working and can't figure it out.  I have ACS 5.2 installed.

My setup is as follows.

6 Locations

2-3 Administrators per location then 3 Administrators for all locations. 

We want to grant access by Location of the Device to AD Accounts.  Then we want 3 Admins to have access to all Locations.    

I have been testing with Riverbeds using TACACS and can get a user working but once I have another user from the All Access group they don't work.  I get a 22056 Error. 

Anyone have something like this working and would not mind explaining to me how to use this convoluted product. 

[Nicolas Darchis]

How about something like this ?

If device.location=location1 and if user belongs to group x,y, or z then grant access

If device.location=location and if user belongs to group x only then grant access

in all other cases deny access.

You can use user groups or usernames directly depending on the similarities between users and what's easiest.