Translations:Extension:SimpleSAMLphp/42/en

Your IdP sends an attribute named "groups" with a list of names like "administrator", "student", "teacher", ... in the SAML response after authentication.