Add check for groups feature flag on SAML group mapping

backend/src/ee/services/saml-config/saml-config-service.ts

@@ -279,6 +279,12 @@ export const samlConfigServiceFactory = ({
       });
     }
 
+    if (enableGroupSync && !plan.groups) {
+      throw new BadRequestError({
+        message: "Failed to enable SAML group sync due to plan restriction. Upgrade plan to enable group sync."
+      });
+    }
+
     const { encryptor } = await kmsService.createCipherPairWithDataKey({
       type: KmsDataKey.Organization,
       orgId
@@ -338,6 +344,12 @@ export const samlConfigServiceFactory = ({
       });
     }
 
+    if (enableGroupSync && !plan.groups) {
+      throw new BadRequestError({
+        message: "Failed to enable SAML group sync due to plan restriction. Upgrade plan to enable group sync."
+      });
+    }
+
     const updateQuery: TSamlConfigsUpdate = {
       authProvider,
       isActive,
@@ -484,7 +496,9 @@ export const samlConfigServiceFactory = ({
 
     const samlConfig = await samlConfigDAL.findOne({ orgId });
     const groupsMetadata = metadata?.find(({ key }) => key === "groups");
-    const shouldSyncGroups = !!samlConfig?.enableGroupSync;
+
+    const plan = await licenseService.getPlan(orgId);
+    const shouldSyncGroups = !!samlConfig?.enableGroupSync && !!plan.groups;
 
     let user: TUsers;
     if (userAlias) {

frontend/src/pages/organization/SettingsPage/components/OrgSsoTab/OrgSSOSection.tsx

@@ -63,7 +63,7 @@ export const OrgSSOSection = (): JSX.Element => {
     try {
       if (!currentOrg?.id) return;
 
-      if (!subscription?.samlSSO) {
+      if (!subscription?.samlSSO || !subscription?.groups) {
         handlePopUpOpen("upgradePlan");
         return;
       }
@@ -215,7 +215,7 @@ export const OrgSSOSection = (): JSX.Element => {
                   id="enable-saml-group-sync"
                   isChecked={data?.enableGroupSync ?? false}
                   onCheckedChange={(value) => handleSamlGroupManagement(value)}
-                  isDisabled={!isAllowed}
+                  isDisabled={!isAllowed || !subscription?.groups}
                 />
               )}
             </OrgPermissionCan>