you may make the login user to be bingding an existing default tunnel-group (DefaultRAGroup) , as the following:
! --- the username and password
ciscoasa(config)#username cisco123 password cisco123
! --- user is connected with the default tunnel-group of the ASA and the group-policy you made .
ciscoasa(config)#username cisco123 attributes
ciscoasa(config-username)#group-lock value DefaultRAGroup
ciscoasa(config-username)#vpn-group-policy xxxx
then you try , whether it is ok ?