acs vpn authorization

[isdep]

I'm trying to authorize users on a vpn against MS active directory through an ACS. I can get RADIUS authentication to work, but I need to be able to limit access based on user, and so far all I'm getting is just authentication. Is there a way to map a vpn 3000 group to an ACS group?

[b.hsu]

The Cisco VPN 3000 Concentrator has the ability to lock users into a Concentrator group which overrides the group the user has configured in the Cisco VPN 3000 Client. In this way, access restrictions can be applied to various groups configured on the VPN Concentrator with the assurance that the users are locked into that group with the RADIUS server.

For configuration section refer to the following link:

http://www.cisco.com/en/US/tech/tk59/technologies_configuration_example09186a00800946a2.shtml