I have given up with IMC and TACACS, I'm using RADIUS instead.
In order to make it work, follow the steps below (roughly described):
On CPPM:
========
1. Create as many Enforcement profiles as you have Operator's Group in IMC, and use aruba VSA attribute as below:
Enforcement_prof1: RADIUS:Aruba Aruba-User-Role = Adminstrator Group
Enforcement_prof2: RADIUS:Aruba Aruba-User-Role = Maintainer Group
Enforcement_prof3: RADIUS:Aruba Aruba-User-Role = My Custom Group
etc ...
2. Create un CPPM policy to assign yours users (operators) to the apropriate Enforcement profiles.
3. Create a RADIUS Service -> PAP and bind it the policy you've just created.
On IMC:
=======
Configure CPPM as RADIUS server
In "Advanced Settings" create the mapping table below:
Vendor ID: 1483 -> Data type: String -> Data Value:Administrator Group -> Operator Group : Administrator Group
Vendor ID: 1483 -> Data type: String -> Data Value:Maintainer Group -> Operator Group : Maintainer Group
Vendor ID: 1483 -> Data type: String -> Data Value:My Custom Group -> Operator Group : My Custom Group
etc ...
A good thing is that you DO NOT need to create local users on IMC.
They will be automatically created the first time they log in.
I hope it helps
Ray