Add SAML group mapping

docs/documentation/platform/sso/google-saml.mdx

@@ -53,6 +53,13 @@ description: "Learn how to configure Google SAML for Infisical SSO."
 
         ![Google SAML attribute mapping](../../../images/sso/google-saml/attribute-mapping.png)
 
+        <Note>
+        For group membership mapping (optional), you can also configure:
+        - **groups** -> **groups** (if you want to sync Google groups to Infisical groups)
+
+        This requires setting up group claims in Google Workspace. See the Group Membership Mapping section below for details.
+        </Note>
+
         Click **Finish**.
     </Step>
     <Step title="Assign users in Google Workspace to the application">
@@ -90,6 +97,27 @@ description: "Learn how to configure Google SAML for Infisical SSO."
 
 </Steps>
 
+## SAML Group Membership Mapping
+
+Automatically sync Google Workspace group memberships to Infisical.
+
+<Steps>
+    <Step title="Add groups attribute mapping in Google">
+        In your Google Admin console SAML app, go to **Attribute mapping** and add:
+
+        - **Google groups**: Include all groups you want to include in the SAML claim. Only these groups will be synced to Infisical.
+        - **App attribute**: `groups`
+
+        ![Google SAML groups attribute mapping](../../../images/sso/google-saml/groups-attribute-mapping.png)
+
+    </Step>
+    <Step title="Enable SAML Group Membership Mapping in Infisical">
+        Back in Infisical, under Organization Settings, enable **SAML Group Membership Mapping** in the **Single Sign-On (SSO)** tab.
+
+        ![Google SAML group membership mapping](../../../images/sso/google-saml/group-membership-mapping.png)
+    </Step>
+</Steps>
+
 <Tip>
     If you are only using one organization on your Infisical instance, you can configure a default organization in the [Server Admin Console](../admin-panel/server-admin#default-organization) to expedite SAML login.
 </Tip>