SAML-multivalue-attributes are commonly encoded separated by semicolons rather than commas: "group1;group2;group3". Please change the separator in UserData:getGroups() to a semicolon. Or better yet, make it a configurable option.