We have two VSS switch pairs, one which has TACACS working correctly with a similar config to this:
aaa group server tacacs+ TacacsVrf server-private 10.4.25.8 key 7 ourKeyIsSecret ip vrf forwarding mgmtVrf ip tacacs source FastEthernet1
with the source interface an individual gigE interface.
We have a second pair (6807xl) with the same config, but using a port-channel Interface as the source interface. TACACS requests are not getting to the ACS as far as I know.