Sending specific active directory groups as SAML attributes

I would probably have done that by creating a custom variable assign with some TCL magic that parses the memberOf attribute in search of the groups in question, and populating the variable with whatever output you would need.