diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/ModeledPermissions.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/ModeledPermissions.java
index be5ac1503b..75887ed094 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/ModeledPermissions.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/ModeledPermissions.java
@@ -20,6 +20,7 @@
 package org.apache.guacamole.auth.jdbc.base;
 
 import com.google.inject.Inject;
+import java.util.Collection;
 import java.util.Collections;
 import java.util.Set;
 import org.apache.guacamole.auth.jdbc.permission.SystemPermissionService;
@@ -212,6 +213,26 @@ public Set<String> getEffectiveUserGroups() {
                 Collections.<String>emptySet());
     }
 
+    /**
+     * Returns the identifiers of all user groups that apply to this entity,
+     * including groups defined within the database (inherited through
+     * membership) and any additional groups provided externally (such as from
+     * an SSO provider like SAML or LDAP). The external groups are used as
+     * additional seeds for recursive DB group expansion, so any parent groups
+     * of external groups in the database are also included in the result.
+     *
+     * @param externalEffectiveGroups
+     *     The identifiers of any externally-asserted group memberships (e.g.
+     *     SAML claims) that should be used as seeds for DB group expansion.
+     *
+     * @return
+     *     The identifiers of all user groups that apply to this entity,
+     *     including DB-inherited parent groups of the external groups.
+     */
+    public Set<String> expandEffectiveGroups(Collection<String> externalEffectiveGroups) {
+        return entityService.retrieveEffectiveGroups(this, externalEffectiveGroups);
+    }
+
     /**
      * Returns a Permissions object which represents all permissions granted to
      * this entity, including any permissions inherited through group
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/ModeledAuthenticatedUser.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/ModeledAuthenticatedUser.java
index 5fd209a683..ccf6cc90d3 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/ModeledAuthenticatedUser.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/ModeledAuthenticatedUser.java
@@ -19,7 +19,6 @@
 
 package org.apache.guacamole.auth.jdbc.user;
 
-import com.google.common.collect.Sets;
 import java.util.Collections;
 import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
@@ -170,11 +169,21 @@ public String getIdentifier() {
     public void setIdentifier(String identifier) {
         user.setIdentifier(identifier);
     }
-    
+
+
+    /**
+     * Expands a user's groups through the parents in database group hierarchy
+     * so that parent groups of external groups (e.g. SAML/SSO group claims)
+     * are included. This also covers the user's own direct
+     * DB memberships (via entity_id) and skeleton users with null entity_id.
+     *
+     * @return
+     *     The set of effective groups for this user, whether inherited or
+     *     direct.
+     */
     @Override
     public Set<String> getEffectiveUserGroups() {
-        return Sets.union(user.getEffectiveUserGroups(),
-                super.getEffectiveUserGroups());
+        return user.expandEffectiveGroups(super.getEffectiveUserGroups());
     }
 
     /**