Option to run setMacros after setGroups
In order to send a list of roles to a SAML application, I would like to construct a macro from the list of resolved LDAP groups.
The documentation clearly states that groups are computed after macros so that a group may rely on an existing macro, but I think that refers to expression-based groups (setLocalGroups) and not UserDB-Based groups (setGroups)
Is there any reason why setMacros have to be run before setGroups ? I see no practical case in which setGroups could need a macro, unlike setLocalGroups.
Would it be alright to instead run things in the following order ? setGroups, then setMacros, then setLocalGroups