Do not redirect to SSO if there is an error message to display
Added group rules that apply to all users
Only remove groups from user when both the group and role match a group rule
Updated documentation