Group membership is determined by the identity-assertion parametergroup.principal.mapping.
identity-assertion
group.principal.mapping