Better handling for blank Group SAML NameID/extern_uid

Problem

If a NameID is missing when trying to sign in with SAML SSO we currently end up with blank database entries. These silently prevent users from re-signing in, and are difficault for a user to debug.

Solution

Prevent blank extern_uid when using a Group SAML Idenetiy, and display a sensible error message to the user.