Use identity provider for role membership

[inghamn]

The starting example this application provides uses a local database and expects staff to maintain user accounts in that database. For our purposes, this is almost always extra management burden that no one wants to do.

The organization's users are already in LDAP or Active Directory, and we could assign users to groups inside of the directory. If we rely on the identity provider (CAS or ADFS) to also send group members during authentication, then we could assign a user's role during the authentication process by reading it from the directory group membership, rather than looking the user account in a local database.