CAS and Active Directory Groups

If the AD groups are exposed as CAS attributes, then you can hook into authorizer_automatically_approve_login and inspect that attribute to decide whether to approve the login. Here’s an example from our institution: https://github.com/uhm-coe/authorizer/wiki/Integrating-WordPress-Roles-with-UH-Groupings#appendix-1-restrict-access-to-specific-uh-groupings

If AD groups aren’t visible from CAS, you can probably use that same hook to do a lookup in AD for the user’s groups and perform your logic there. Hope that helps!