fix

apps/sonar/sonar_Service.tf

@@ -41,6 +41,7 @@ module "application" {
   app_group         = var.app_group
   dns_name          = local.dns_name
   icon              = local.icon
+  sub_groups        = ["admin"]
   protocol_provider = module.saml.provider-id
   providers = {
     authentik = authentik
@@ -55,6 +56,15 @@ module "saml" {
   dns_names         = local.dns_names
   namespace         = var.namespace
   labels            = local.common_labels
+  group_mapping     = <<ENDF
+for group in user.ak_groups.all():
+    if group.name == "authentik Admins":
+        yield "admin"
+    elif group.name == "app-${local.app_name}-admin":
+        yield "admin"
+    else:
+        yield group.name
+ENDF
   providers = {
     kubectl = kubectl
     authentik = authentik