function isAdmin(p, samlAdminGroup) {
  // The saml api only gives an array if more then one value for an attribute is given otherwise a plain string.

  /**
   * This one is AzureAD specific, and emulates the OIDC roles structure in SAML.
   *
   * @type string[] | undefined
   */
  const appRoles = p[CLAIMS.role];
  if (appRoles) {
    // So in case multiple roles are send.
    if (Array.isArray(appRoles) && appRoles.include('admin')) return true;
    else if (appRoles === 'admin') return true;
  }

  /** In AzureAd this may need to be enabled explicitly */
  if (samlAdminGroup && samlAdminGroup.length > 0) {
    /**
     * This one is AzureAD specific, but allows you to specify access based on a AD group.
     * NOTE: it is almost always a UUID, but it can be remapped to a group attribute in AzureAD.
     * @type string[] | undefined
     */
    const userGroups = p[CLAIMS.groups];
    if (userGroups) {
      if (Array.isArray(userGroups) && userGroups.includes(samlAdminGroup))
        return true;
      else if (userGroups === samlAdminGroup) return true;
    }
  }

  return false;
}
Use claims to determine the role of the user instead of having it managed in SQLPad.

@param {import('passport-saml').Profile} p