Cerberus supports plugging in different authentication backends. The example below shows OneLogin but Okta is also supported and others can be added easily. LDAP groups are used to provide role-based access with either read or read/write permissions.