The new listener script univention-saml-groups.py which creates / updates the "SAML SP to LDAP groups" mapping in /etc/simplesamlphp/serviceprovider_enabled_groups.json first creates a temporary file in /tmp/ where it sets the correct file permissions and ownership and then uses shutil.move() to move that to the final destination in /etc/simplesamlphp/

This only works correctly if the /tmp/ and /etc/simplesamlphp/ directories are on the same filesystem, because shutl.move() uses os.rename() in this case, which keeps all file metadata.
Hoever, if these two directories are on separat filesystems, shutil.move() by default uses shutil.copy2() to copy the file to the new location and then deletes the source file.
According to the python documentation "copy2() uses copystat() to copy the file metadata." which in turn states that it doesn't copy the file owners.
("Copy the permission bits, last access time, last modification time, and flags from src to dst. On Linux, copystat() also copies the “extended attributes” where possible. The file contents, owner, and group are unaffected.")

So the target file gets created with default owner and user, in our cases this was "root.nogroup".
This has the effect that simplesamlphp process cannot read the file, as the following syslog entries show:

simplesamlphp[21022]: 3 [5bf27ee2ac] SimpleSAML_Error_Exception: Error 2 - file_get_contents(/etc/simplesamlphp/serviceprovider_enabled_groups.json): failed to open stream: Permission denied


Our hotfix was to change the variable "tmp_path" in univention-saml-groups.py as follows:
tmp_path = path + ".tmp"

So it creates the temporary file in the same directory as the final .json file and then just moves it inside that directory, keeping mode and ownership.