I have Shibboleth authenticating to Active Directory and i'm trying to figure out a way to restrict authentication based on group membership. Has anyone done anything like that before?