Did you make sure that the users are part of the intranet group (via /admin/ug). ACS has this funky way of requiring you to be parts of a few diffrent groups to authenticate in /intranet .. I've never understood what they were smoking when that was first put together.. IF that does't work, yank up your logging and send a more verbose log.
