Here are a few reasons why this error could be happening.
1) There may be a protocol mismatch (for example if you are using MS-CHAP v1 or v2 on the NAS and client you cannot use TACACS this is because TACACS does not support MSCHAP so need to use RADIUS.
2) There may be a possibility of trust is not configured between domains. (If your user is on AD)
3) If your ACS server is not on domain controller you need to take care of the member server configuration so that it communicates to AD.
4)Make sure that you are running the supported service pack and server type with corresponding ACS software version.
Try this link:
http://www.cisco.com/warp/public/480/csntfaq.html