Can you please check the role the user is landing on ?
Show rights <role name>
Check the show datapath session table <IP address> to see if anything is getting denied
Do you have any acls on your servers denying certain ports from your wireless segment ?