private Set<String> getGroups(AssertedIdentity identity)
            throws GuacamoleException {

        List<String> samlGroups = identity.getAttributes().get(confService.getGroupAttribute());
        if (samlGroups == null || samlGroups.isEmpty())
            return Collections.emptySet();

        return Collections.unmodifiableSet(new HashSet<>(samlGroups));

    }
Returns a set of all group memberships asserted by the SAML IdP.

@param identity
    The {@link AssertedIdentity} representing the user identity
    asserted by the SAML IdP.

@return
    A set of all groups that the SAML IdP asserts this user is a
    member of.

@throws GuacamoleException
    If the configuration information necessary to retrieve group
    memberships from a SAML response cannot be read.
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/user/SAMLAuthenticatedUser.java