Function role_for_groups 

pub fn role_for_groups(groups: &[String], config: &OidcConfig) -> Option<Role>

Maps IdP groups to a role. None means the user may not log in.