All the documentation says that all group membership must be passed, but I have read and heard that that is not strictly the case.  I have a customer that is using RapidIdentity (RI) and their RI does not include all AD groups.  What groups must be included (right now we are including any AD groups used in LF access rights) in order to link the SAML user account with the local AD user and get logged in?