@joshua
Thanks. I've up-voted a few of those open issues.

Since I'm trying to make this work for a COTS application I don't have the luxury of injecting another API call.

For now I'm pretending that the groupId being returned is the LDAP distiguished name for the group (I prefixed it in the Lambda with dn=). Then I can trick the application to looking up the group by the LDAP dn instead of name.

I've figured out how to get the groupids in the response but not translate them into group names.

How would I go about constructing a lamdba to add a list of groups a user belongs to to the samlResponse.assertion?