Identity aware-based ACL problem

I want to apply ACLs based on user identity (actually, AD group membership). USers connect via RA-VPN though a full webtop. This is a piece of cake with APM using a AD Group Assignment Resource agent...