Custom session variable for filtered memberOf AD attribute

Sorry, I should have provided more information. We are actually passing these session variables as SAML attributes to another product (zscaler). And, it turns out that you can't have more than 8 groups on that device, so we need a way to filter them down to just the groups that are meaningful to the zscaler configuration.