AEM ships with a SAML authentication handler. This handler provides support for the SAML 2.0 Authentication Request Protocol (Web-SSO profile) using the HTTP POST binding.
1. signing and encryption of messages
2.automatic creation of users
3. synching groups to existsing ones in AEM
4. Service Provider and Identity Provider initiated authentication
This handler stores the encrypted SAML response message in the user-node ( usernode/samlResponse ) to facilitate communication with a third-party Service Provider.
We have a usecase like: We have integrated AEM SAML(OOTB) with Azure AD for user authentication. Now In Azure they have limitation that they can provide max of 150 groups(user belongs to) in saml response. In our case we have some users who belongs to more than 150 groups and in this case in saml response we get a url link in place of group information. User gets authenticated from azure but couldn't landed up with any AEM screen as saml response doesn't contain group information to redirect user to authorized page. Azure team says we need to call a rest m/s graph api to get group information in such case using that link.
Can anyone suggest how we can achieve this? Do we need to write custom SAML authentication handler? how to call graph apis?