AEM's SAML handler doesn't parse out the CN from the DN. However, you can just use the DN in AEM and it doesn't have to be visible to users. You can create the groups in AEM with the DN as the id, for example, "CN=APP-CRM-BUILD-PROFILE-CSR,OU=Resources,OU=_Groups,DC=lan,DC=xxxx,DC=org", then just gi...