Authenticate users via SAML and map external user groups to scopes