Sure, run 12.2(8)T or above on the router, and follow this:
http://www.cisco.com/warp/public/480/ipsec-ios-tacacs.html
Note this is for TACACS user authentication, if you want to do this locally on the router do the following:
aaa authentication login userauthen group local
username password
You can have as many "username...." lines as you like.
The split tunnelling part of the config is detailed at the end of the VPN client configuration in the sample config.
