tacacs attibute value pair settings for remote role attributes

I believe the attribute within ACS needs to be populated under the group configuration, shell profiles section. There's a pane for attributes and it should be populated with the same attribute as you put in the corresponding remote role within the BIG-IP.

For example, our attribute for administrators is F5-LTM-User-Role-1=adm. This goes in the custom attributes under the shell profile section of ACS as well as your remote role configuration as the attribute string.