Add option to assign "role" or "group" based on SSO 'role' field