Unable to specify main team saml group descriptions which contain the comma character

Summary

I'm unable to specify the CONCOURSE_MAIN_TEAM_SAML_GROUP flag if the group name I want to use contains a , character.

https://github.com/concourse/dex/blob/master/connector/saml/saml.go#L424 The saml group delimiter is ',' and there is no logic for escaping the character or quoting it so that you can include it in the group name.

In our setup we end up using LDAP group descriptions which contain commas.. e.g.

CN=my_concourse_admin,OU=SecurityGroups,DC=example,DC=com

This group name works when using fly set-team -c teamconfig.yaml where teamconfig.yaml contains the following:

roles:
- name: owner
  saml:
    groups: ["CN=my_concourse_admin,OU=SecurityGroups,DC=example,DC=com"]

Steps to reproduce

set the MAIN_TEAM_SAML_GROUP flag using an environment variable:

CONCOURSE_MAIN_TEAM_SAML_GROUP='CN=my_concourse_admin,OU=SecurityGroups,DC=example,DC=com

Connect to saml in an environment where the groups attr passed to concourse is formatted like this:

[\"CN=my_concourse_publish,OU=SecurityGroups,DC=example,DC=com\"
\"CN=my_concourse_admin,OU=SecurityGroups,DC=example,DC=com\"
]

etc.

Attempt to log in using the main team.

Expected results

CONCOURSE_MAIN_TEAM_SAML_GROUP='CN=my_concourse_admin,OU=SecurityGroups,DC=example,DC=com' should show the following when running fly get-team -n main saml:cn=my_concourse_admins,ou=securitygroups,dc=example,dc=com

Actual results

Each comma delimits a separate group and the main team config becomes saml:cn=my_concourse_admins,saml:ou=securitygroups,saml:dc=example,saml:dc=com

Additional context

As a workaround: setting the group using a flag seems to work. concourse web --main-team-saml-group=CN=my_concourse_admin,OU=SecurityGroups,DC=example,DC=com

Triaging info

• Concourse version: v7.6.0
• Browser (if applicable): N/A
• Did this used to work? no (but works using fly set-team)