I'm currently working on integrating SAML 2.0 authentication with Jenkins, and I've encountered a challenge regarding the parsing of group attributes received in the SAML response. Here's a detailed overview of the situation and the specific problem I'm facing.

Setup:

• Successfully implemented SAML 2.0 authentication in Jenkins.
• Upon authentication, user attributes such as first name, last name, email, and groups are retrieved from the SAML response.
• The group attribute is formatted as a single string where multiple groups are concatenated and separated by " ^ ", like this "CN=Adgroup1,ou=groups,dc=example,dc=net^CN=Adgroup2,ou=groups,dc=example,dc=net^CN=Adgroup3,ou=groups,dc=example,dc=net"

Issue Description:

• I'm using the Project-Based Matrix Authorization Strategy in Jenkins to control access to specific jobs based on users' group memberships.
• However, Jenkins is treating the entire group string as a single group during authorization checks.
• The desired behavior is for Jenkins to parse and recognize individual groups (e.g., adgroup1, adgroup2, adgroup3) from the group attribute string.

Constraints and Considerations:

• Changes cannot be made to the SAML response format as it complies with standards and is managed by the Identity Provider (IDP).

• The SAML response structure for the group attribute is as follows:

<ns2:Attribute Name="Groups" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"> ns2:AttributeValueCN=Adgroup1,ou=groups,dc=example,dc=net^CN=Adgroup2,ou=groups,dc=example,dc=net^CN=Adgroup3,ou=groups,dc=example,dc=net</ns2:AttributeValue> </ns2:Attribute>

How can I configure Jenkins or modify the Project-Based Matrix Authorization Strategy to correctly parse and distinguish individual groups from the SAML group attribute string? I need a solution that accommodates the CN, ou, and dc details present in the group attribute format without modifying the SAML response itself. Any insights, suggestions, or specific configurations would be greatly appreciated. Thank you!