IPSec VPN Local User fails XAuth since upgrade to 5.2.3 (worked on 5.2.2)

[x_member]

Just come across this issue whilst preparing to take a Fortigate 60D unit live after an upgrade from 5.2.2 to 5.2.3.

config vpn ipsec phase1-interface

edit "Mobile"
set type dynamic
set interface "wan1"
set mode-cfg enable
set proposal aes256-md5 3des-sha1 aes192-sha1
set dhgrp 5 2
set xauthtype auto
set authusrgrp "remoteUsers"
set ipv4-start-ip 192.168.16.226
set ipv4-end-ip 192.168.16.250
set dns-mode auto
set ipv4-split-include "wizard-address-internal"
set psksecret ENC *************************
next
end
config vpn ipsec phase2-interface
edit "Mobile"
set phase1name "Mobile"
set proposal aes256-md5 3des-sha1 aes192-sha1
set pfs disable
set keepalive enable
next
end

The group remoteUsers contains LDAP users authenticated on active directory and a local user for use if the AD server fails.

It is the local user who can no longer connect successfully (LDAP authentication behaves correctly) as the debug shows.

ike 0:Mobile_0:20: received XAUTH_USER_NAME 'theuser' length 7
ike 0:Mobile_0:20: received XAUTH_USER_PASSWORD length 15 
ike 0:Mobile_0: XAUTH user "vpnUser"
ike 0:Mobile: auth group remoteUsers
ike 0:Mobile_0: XAUTH failed for user "theuser", retry(1).
ike 0:Mobile_0:20: sending XAUTH request

The same user group is also used for a SSL VPN. On that VPN, the local user authenticates without issue.

I've had a further look at 5.2.3 release notes and can see no reason why this would have changed - can anyone advise?