Admin Dashboard with SAML

Is there a way to configure users for the admin dashboard when using SAML? I have read through the documentation that I could find. I have seen simple authentication and LDAP.

In practice to control access to an application I use access-expressions (rather than access groups) because I need SPEL to parse out the roles that my IDP provides, which arrive in one long string.

Adding additional simple passwords isn’t sufficient as my security officer disallows these, they’ve already pulled the plug on Grafana for example.

It’s not obvious to me what will work here. Can I use access-expressions do define groups?