https://issues.shibboleth.net/jira/browse/IDP-1723 There's no official workaround until 4.1 to prevent it, other than "don't use groups", since that's been the advice for a while. -- Scott