For debug purpose:

Debug ldap 255
Debug aaa common 255

test aaa-server authentication AD-Group host 10.10.1.2 username ABCUSER password NIHAOCHINA

Command examples:

ldap attribute-map AnyConnect_Ldap
  map-name  memberOf IETF-Radius-Class
dynamic-access-policy-record DfltAccessPolicy
dynamic-access-policy-record AnyConnect_Users_dp
 description "This for NIHAO-China User Access"
 network-acl AnyConnect_***_User
aaa-server NIHAO-AD-Group protocol ldap
aaa-server NIHAO-AD-Group (inside) host 10.10.1.2
 ldap-base-dn OU=Users,OU=NIHAO - China,DC=NIHAO,DC=local
 ldap-scope subtree
 ldap-naming-attribute sAMAccountName
 ldap-login-password *****
 ldap-login-dn CN=Ni Hao,OU=Users,OU=NIHAO - China,DC=NIHAO,DC=local
 ldap-login-dn CN=Ni Hao,OU=Contractors,OU=Users,OU=NIHAO - China,DC=NIHAO,DC=local

 server-type microsoft
aaa authentication telnet console LOCAL
aaa authentication ssh console LOCAL

web***
 port 8000
 enable outside
 anyconnect-essentials
 svc image disk0:/anyconnect-win-3.1.04063-k9.pkg 1
 svc enable
 tunnel-group-list enable
group-policy AnyConnect_Group_Policy internal
group-policy AnyConnect_Group_Policy attributes
 dns-server value 10.10.1.2
 ***-tunnel-protocol svc web***
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value AnyConnect_Split_Tunnel
 default-domain value NIHAO.Local
 web***
  svc keep-installer installed
  svc dpd-interval client 30

username NIHAO*** password TUIANTUABGAIXUBQUB encrypted
username NIHAO*** attributes
 service-type remote-access
tunnel-group AnyConnect_Tunnel_Group type remote-access
tunnel-group AnyConnect_Tunnel_Group general-attributes
 address-pool AnyConnect_***_User
 authentication-server-group NIHAO-AD-Group
 default-group-policy AnyConnect_Group_Policy
tunnel-group AnyConnect_Tunnel_Group web***-attributes
 group-alias AnyConnect_Users enable
!