SAML group sync

### Problem Statement Hey everyone. We're in process of self-hosting sentry in our company to make it a part of our internal developer platform, along with some other tools. To authorize developers and manage access in all the tools we use SSO [keycloak], connecting it through (mostly) OIDC. Sentry does support SAML, which helps with logging users in, but it lacks groups sync to manage users' access to projects. The groups claim is passed from SSO to sentry as `http://schemas.xmlsoap.org/claims/Group` attribute, but sentry doesn't use it. Something like this is done by SCIM, but as far as I understood it syncs only the list of groups, not mapping users. ### Solution Brainstorm Add "groups claim" to SAML attribute settings and map it to teams. On user login sentry has to run through user groups, check if team with the same name exists, if not – creating it, and adding a user to it. Maybe the "default team role" setting is also needed, but imo adding everyone as members should be enough. ### Product Area Sign In