LDAP Auth not working on SSL VPN after upgrade to 5.6.6

I don't know if this is an LDAP issue or an SSL VPN configuration issue but I'll start by posting it here.  This thing has been giving me a headache for a couple of days so it's time to seek help.

I've got three 80C's in three offices around the world.  All are configured identically as far as SSL VPN goes and all were working in the past.  They all authenticate against the same LDAP server where users who are members of the "VPN Users" group are allowed to log in.  I recently upgraded the firmware on one firewall from 5.4.4 to 5.4.6 and it appears it's been since this time that I can no longer log in to that firewall while the other two still work fine.  When I try on this firewall, I get a "Permission denied" error and the logs on the firewall also show the permission is denied with a "SSL user failed to log in" message.

If I run a tcpdump on the directory server, I see some initial back and forth which I assume is the handshake, then I see a couple of packets from the firewall that get responded to via the directory server as ICMP host unreachable - admin prohibited packets.  However, if go into the LDAP server config on the firewall and click Test Connectivity it all works fine and the tcpdump looks normal.  I've checked my iptables on the directory server and the firewall is definitely allowed - besides, if that was the problem then the connectivity test would fail. Also, I can browse the directory fine from the firewall.

I've got no idea what to look at.  Everything looks the same on both firewalls.  I have noticed that there's an SSL-VPN Realms page on the 5.6.6 that doesn't exist on 5.6.4 interface.  I don't have anything configured under there, not sure if I need to.  I'm almost tempted to role back to 5.6.4 but I'd rather fix the issue.