can someone please help me on this where i am struggling to write the logic in expression.

created a  SAML auth service to provide the access to diff users based on their security group:

attribute names from IDP : mplid and memberof

values in memberof  are group1,group2

if the user is part of gorup1 then provide the access as admin for the application, if the user is part of gorup2 then provide the access as read only otherwise no access.