AEM's SAML handler doesn't parse out the CN from the DN. However, you
can just use the DN in AEM and it doesn't have to be visible to users.
You can create the groups in AEM with the DN as the id, for example,
"CN=APP-CRM-BUILD-PROFILE-CSR,OU=Resources,OU=_Groups,DC=lan,DC=xxxx,DC=org",
then just give the group a friendly name in the group title. Why the
need for it to be the CN? DN isn't a bad thing, it avoids naming
conflicts.