ValidateCredentialClaims - Access Denied: Claims stored in the credentials did not match with the group claim for a group app

Hey,

did setup bcs before (on beta version), worked without any problem (but database on same server).

I try it now, keep on getting errors

I followed again (several times) following link http://fabiangwilliams.wordpress.com/2010/04/16/how-to-create-configure-consume-sharepoint-2010-secure-store-in-business-connectivity-services/

so, I have an user dom\bcsbroker, and a group dom\bcsusers with two users dom\geert and dom\els

dom\bcsbroker has public, read and write on sql database

my secure store application has dom\bcsusers as credential owners, dom\bcsbroker name and password has been entered in "windows user name" and following

i get following errors:

ValidateCredentialClaims - Access Denied: Claims stored in the credentials did not match with the group claim for a group app.

and then

The Microsoft Secure Store Service application Secure Store Service failed to retrieve credentials. The error returned was 'Access is denied.'. For more information, see the Microsoft SharePoint Products and Technologies Software Development Kit (SDK).

Sharepoint 2010 is installed on 2008r2, database is sql2008r2 on other server.

Please help