Restrict user authentication for some group for SAML client

Yes, that’s right. In theory. But the real world does not care about theory.
We had this discussion a few weeks ago…