I want to auto-assign permission sets based on a user's membership in various security groups in Active Directory ("AD"), during the Just-in-Time user provisioning process. I understand that this could theoretically be possible with an Apex handler. Can anyone can confirm that Salesforce can receive a list of security group memberships from AD that can be read in Apex?
This would have to be sent in the SAML response and read in ApEx. Since SF (acting as a SAML SP) is reading the attributes in the SAML response and transforming them to a Map which is then passed to your ApEx code, the answer to your question largely depends on how your identity provider transmits these groups. As a lowest common denominator, if each group is represented as a unique attribute on the assertion, SF will pick it up.
You can do this with a Group Claim under "SAML-based Sign-on -> User Attributes & Claims" if you are syncing your On-Premise to Azure.
This can also be done with a claim condition using group membership. This is not ideal, but it appears to be working for us.
User type Scoped Groups Source Value Any 1 groups Attribute "Your Value"
Hope this helps someone.