SSL VPN w/ Fortitoken, Fortiauthenticator, Multiple AD Domains.

In the environment, it is one company with many AD domains.  There is a business need to make sure that users in one domain cannot access resources in another.  The current SSLVPN set up is as follows:

Fortigate has an LDAP server defined for each domain.  The Fortigate has a firewall group linked to distinguished name of a group in the AD domain.  The group then has a dedicated VPN portal, dedicated IP range, and dedicated policies that define what resources it can access.  This is done for each domain.

The customer has added some new requirements:

1.  Two Factor Authentication (via Fortitoken)

2.  Additional domains (this puts us above the 10 LDAP server limit in Fortigate)

I'm doing a PoC of Fortiauthenticator and Fortitoken and have hit a wall.  I've completed the following:

-FAC connects to LDAP server.

-Imported user from LDAP as a remote user.

-Created group and added the remote user.  We'll call the group "corp"

-The test user has been assign a Fortitoken.

-Fortigate was configured as a RADIUS client.

On the Fortigate:

-Set up the FAC as a RADIUS server.

-Set up a firewall group called "corp" that uses the FAC as the remote server and specifies the group "group"

-Created a VPN portal and IP range.

-Created a VPN authentication rule mapping the group to the portal.

-Set up policies allowing the IP range and group access to the resources.

When trying to connect:

-I enter user ID & password with domain\user (with domain being a realm on FAC with a matching name)

-I get prompted for the OTP

-Upon entering the OTP from Fortitoken, VPN progresses to 45% then fails with "access denied -455"

The logs on the FAC show the authentication attempt as successful both via LDAP and Fortitoken.

The logs on the Fortigate show the connection attempt as "sslvpn_login_permission_denied"

Thoughts?