How can I assign the groups from the Saml assertion to a variable?

Hello,

you need to use tcl expression your variable assign to reformat the output. when doing an AD query memberOf attribute looks like :

group1 pipe group3 pipe group3

here is some examples of tcl syntax when you extract subect name from ssl certificate : https://support.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-config-11-4-0/apm_config_advanced_policies.html