Thank Ujwol, Julien.
Last time I look at expressions was in the v6.0 days!
To get multi-value CN of all the groups, docops Example 1 works.
Attributes and Expressions Reference - CA Single Sign-On - 12.52 SP1 - CA Technologies Documentation
Example 1
Virtual User Attribute #GetCN set to RDN( STRING(%0),FALSE)
ENUMERATE(SM_USERGROUPS, #GetCN)
I created an Expression #GetCN and used Enumerate. Example 2 does NOT work.
Example 2
ENUMERATE(SM_USERGROUPS, STRING(RDN(%0, FALSE)))
So putting it all together to get CN with commas I use:
TRANSLATE(ENUMERATE(SM_USERGROUPS, #GetCN), '^', ',')
The result is: