Merge pull request #1544 from kenperkins/saml-groups

Adding support for allowed groups in SAML Connector

Documentation/connectors/saml.md

@@ -14,6 +14,10 @@ __The connector doesn't support refresh tokens__ since the SAML 2.0 protocol doe
 
 The connector doesn't support signed AuthnRequests or encrypted attributes.
 
+## Group Filtering
+
+The SAML Connector supports providing a whitelist of SAML Groups to filter access based on, and when the `groupsattr` is set with a scope including groups, Dex will check for membership based on configured groups in the `allowedGroups` config setting for the SAML connector.
+
 ## Configuration
 
 ```yaml
@@ -44,6 +48,10 @@ connectors:
     emailAttr: email
     groupsAttr: groups # optional
 
+    # List of groups to filter access based on membership
+    # allowedGroups
+    #   - Admins
+
     # CA's can also be provided inline as a base64'd blob.
     #
     # caData: ( RAW base64'd PEM encoded CA )