I have gotten this to work using Clearpass to provide the authentication for the VPN gateway.
I was deploying it with a Fortigate firewall as the VPN gateway. So I got it working using a Radius Enforcement Service that returned a Fortinet VSA of Fortinet-Group-Name to the firewall.
Let me know if further detail would be useful.