SSO groups without completely overriding

[Falco]

@sam

Aside from groups , you may also specify group membership in your SSO payload using the add_groups and remove_groups attributes regardless of the sso overrides groups option.

add_groups is a comma delimited list of group names we will ensure the user is a member of.
remove_groups is a comma delimited list of group names we will ensure the user is not a member of.

The add and remove parameters do exactly what you need.