Multiple group ldap on sslvpn

Hi, Do anyone here configured smartcard authentication via ldap groups? If yes do you able to use multiple ldap groups for user? My case version 5.6.8 I found that when user authenticate via sslvpn client certificate based , the user match the first firewall group found in policy and not matching other groups he have in policy / AD. I already have TAC opened but ID like to verify if someone here encouraged same problem? Regards,