function getSamlRole(p, samlAdminGroup, samlDefaultRole) {
  if (isAdmin(p, samlAdminGroup)) return 'admin';
  return samlDefaultRole;
}
This one is AzureAD specific, but allows you to specify access based on a AD group.
NOTE: it is almost always a UUID, but it can be remapped to a group attribute in AzureAD.
@type string[] | undefined