Hi,
I have a very similar problem anfer upgrading from 3.2.
To find out more enable full logging (System Config - Service Control) and see the CSAuth log file under Program Files\CiscoSecure ACS v4.0\CSAuth\Logs... It should give you a more specific reason.