Hi Sven,
afaik, SAML only takes care of authenticating the user, the authorization (assignment of users to groups) is still done over the ldap sync, where you can optionally map the user roles using AD groups or assign them by hand. User management with LDAP/Active Directory
Gerd