Explanation
user is a Linux kernel namespace that is disabled by default and must be enabled at Docker engine runtime to be used. According to the official documentation, user namespace support must be explicitly enabled in two ways:
The dockerd daemon must be started with --userns-remap flag.
The user or group specified for --userns-remap must have subordinate user and group IDs allocated in
/etc/subuid and /etc/subgid files.
References: https://docs.docker.com/engine/security/userns-remap/#enable-userns-remap-on-the-daemon
https://docs.docker.com/engine/security/userns-remap/#prerequisites-for-user-namespace-remapping

Explanation
= SAML is a supported user authentication method for Universal Control Plane (UCP). UCP has its own built-in authentication mechanism and integrates with LDAP and Active Directory. It also supports Role Based Access Control (RBAC) and Docker Content Trust. UCP allows you to configure SAML as an authentication method and connect it to your Identity Provider (IdP). You need to provide the Entity ID and the ACS URL from UCP to your IdP, and the SAML Sign-on URL and the x509 Certificate from your IdP to UCP12. References:
* SAML | Docker Docs
* Configure Single Sign-On | Docker Docs

Explanation
This does not describe the role of Control Groups (cgroups) when used with a Docker container, because user authorization to the Docker API is not related to cgroups. According to the official documentation, cgroups are a Linux kernel feature that limits and isolates the resource usage of a group of processes, such as CPU, memory, disk I/O, network, etc. Docker can use cgroups to share available hardware resources to containers and optionally enforce limits and constraints.
References: https://docs.docker.com/config/containers/runmetrics/
https://bikramat.medium.com/namespace-vs-cgroup-60c832c6b8c8