Please check the ADE logs and see if you can find anything reported issue. You can check those logs with the command "show logging system ade/ADE.log". If nothing obvious showing on the logs, then until you talk to TAC I think you can try to shutdown...
Then you can configure the RADIUS server to return the tunnel group attribute, in that case the users will be transparently landing into their tunnel group without any interaction from their side. Also, the tunnel group selection in this case can be ...