Now solved was a permissions issue in ACS.
However this raises an interesting "issue" with CSM and its interaction with ACS.
According to the CSM 4.1 Installation Guide:
http://www.cisco.com/en/US/docs/security/security_management/cisco_security_manager/security_manager/4.1/installation/guide/aduser.html
ACS Changes Not Appearing in Security Manager
When you are using Security Manager with Cisco Secure ACS 4.x, information from ACS is cached when you log in to Security Manager or CiscoWorks Common Services on the Security Manager server. If you make changes in the Cisco Secure ACS Network Configuration and Group Setup while logged in to Security Manager, the changes might not appear immediately or be immediately effective in Security Manager. You must log out of Security Manager and Common Services and close their windows, then log in again, to refresh the information from ACS.
If you need to make changes in ACS, it is best practice to first log out of and close Security Manager windows, make your changes, and then log back in to the product.
The problem here as I see it is is as follows:
1) BEcause CSM caches a copy of credentials when you get a permissions error such as the one above you don't get any failure in the ACS logs (as you would expect) because CSM is using its cached copy, not very helpful for troubleshooting, not very good for security as you are not getting any logs for people attempting to do things they aren't allowed to.
2) Surely for a secutity product (as CSM is supposed to be) caching the details from ACS is bad practice. This means if someones permissions are revoked, as long as they continue to remain logged into CSM they can still do things using the cached copy of ACS permissions - surely a very bad thing for a security product.
