Hey there.
Are you using a means of Delegated Authentication (LDAP, SAML, GitHub, etc.) and also using group mapping?