[MM-56491] Allow sysadmins to LDAP sync SAML users when SamlSettings.EnableSyncWithLdap is true (#25886)

Co-authored-by: Mattermost Build <build@mattermost.com>

server/channels/api4/ldap.go

@@ -433,7 +433,7 @@ func addUserToGroupSyncables(c *Context, w http.ResponseWriter, r *http.Request)
 		return
 	}
 
-	if user.AuthService != model.UserAuthServiceLdap {
+	if user.AuthService != model.UserAuthServiceLdap && (user.AuthService != model.UserAuthServiceSaml || !*c.App.Config().SamlSettings.EnableSyncWithLdap) {
 		c.Err = model.NewAppError("addUserToGroupSyncables", "api.user.add_user_to_group_syncables.not_ldap_user.app_error", nil, "", http.StatusBadRequest)
 		return
 	}

server/channels/api4/ldap_test.go

@@ -309,4 +309,28 @@ func TestAddUserToGroupSyncables(t *testing.T) {
 	resp, err = th.SystemAdminClient.AddUserToGroupSyncables(context.Background(), user.Id)
 	require.NoError(t, err)
 	CheckOKStatus(t, resp)
+
+	t.Run("should sync SAML users when SamlSettings.EnableSyncWithLdap is true", func(t *testing.T) {
+		id = model.NewId()
+		user = &model.User{
+			Email:       "test123@localhost",
+			Username:    model.NewId(),
+			AuthData:    &id,
+			AuthService: model.UserAuthServiceSaml,
+		}
+		user, err = th.App.Srv().Store().User().Save(th.Context, user)
+		require.NoError(t, err)
+
+		resp, err = th.Client.AddUserToGroupSyncables(context.Background(), user.Id)
+		require.Error(t, err)
+		CheckForbiddenStatus(t, resp)
+
+		th.App.UpdateConfig(func(cfg *model.Config) {
+			*cfg.SamlSettings.EnableSyncWithLdap = true
+		})
+
+		resp, err = th.SystemAdminClient.AddUserToGroupSyncables(context.Background(), user.Id)
+		require.NoError(t, err)
+		CheckOKStatus(t, resp)
+	})
 }