Steps to reproduce:

1.) User is logged into Jenkins via SAML session
2.) User is added to AD Group by AD Admin
3.) User can hit /whoAmI endpoint and see new group added
4.) User is not able to access folders with group
5.) User has to logout of SAML session
6.) Admin has to logout of SAML session
7.) Admin has to login to new SAML session
8.) Admin has to manually add user to group in Jenkins Groups UI.
9.) User can now login and access folders with group

I've looked at this with fbelzunc and he believed it to be a problem with https://github.com/jenkinsci/saml-plugin/blob/master/src/main/java/org/jenkinsci/plugins/saml/SamlGroupDetails.java