Hi Blake,
Strictly speaking, they do not. However, customers should not deviate from the guidance unless they fully understand the potential downsides and risks of sending a partial group list and are confident they have the controls in place to mitigate those.
At a technical level, only the AD groups sent in the IdP SAML response are written into the Groups attribute of the user's LFDS STS token. Laserfiche applications only look at a user's STS token's Groups values to evaluate membership for access rights/features/privileges/etc.
We provide the guidance to send all AD groups in the SAML response because it is rare that the people configuring SAML and Linked Identity Providers (who might understand that nuance) are the same ones setting Laserfiche security rights a year later.
We hope to avoid scenarios where someone might set important security rights on an AD group (because they know users log in with their AD creds) that isn't getting passed in the SAML response even though users are members in AD. This is beyond most SPs and customers' ability to diagnose themselves, requires advanced technical knowledge of both SAML and LFDS to even troubleshoot, and would regularly generate complicated support cases.
In your scenario of a centrally-managed enterprise Laserfiche deployment for a very large organization, you can proceed with sending a filtered group list in the IdP SAML token. You'll want to ensure the following:
- The AD group filter criteria for the SAML IdP is clearly documented and kept up to date
- A comprehensive list of Laserfiche-related AD groups is clearly documented and kept up to date
- Any policies or procedures your org has for setting security rights in Laserfiche on AD groups involve first checking the above documentation to validate the group is getting sent. This includes making AD groups members of LFDS Laserfiche groups.
Don't forget that you need the SAML IdP to send the AD groups in SID format.
Cheers,
Sam