remove this restriction:
The Groups.contains , Groups.startsWith , and Groups.endsWith group functions are designed to work only with group claims. You can’t use these functions with property mappings.
which seems incredibly superficial to me, and there are super cool use cases you could do with that in property mappings (e.g. assign permissions based on group membership with everything “just working” because it’s based on naming conventions).
so, feature request: make it work in property mappings