diff --git a/app/views/ops/_rbac_group_details.html.haml b/app/views/ops/_rbac_group_details.html.haml
index 942aa121c8c..fe72111a10a 100644
--- a/app/views/ops/_rbac_group_details.html.haml
+++ b/app/views/ops/_rbac_group_details.html.haml
@@ -1,6 +1,10 @@
 - if @edit
   - url = url_for_only_path(:action => 'rbac_group_field_changed', :id => (@edit[:group_id] || "new"))
   - combo_url = "/ops/rbac_group_field_changed/#{@edit[:group_id] || 'new'}"
+- mode = ::Settings.authentication.mode
+- saml_enabled = ::Settings.authentication.saml_enabled
+- can_lookup_groups = mode.downcase.start_with?('ldap')
+- can_lookup_groups = mode.downcase == "httpd" && ! saml_enabled unless can_lookup_groups
 = render :partial => "layouts/flash_msg"
 #group_info
   %h3
@@ -21,7 +25,7 @@
                            :class => "form-control",
                            "data-miq_observe" => {:interval => '.5',
                                                   :url      => url}.to_json)
-          - if ::Settings.authentication.mode.casecmp('database') != 0
+          - if can_lookup_groups
             = check_box_tag("lookup",
                             "1",
                             false,
diff --git a/spec/views/ops/_rbac_group_details.html.haml_spec.rb b/spec/views/ops/_rbac_group_details.html.haml_spec.rb
index 7848f3805d3..74c3afb3f11 100644
--- a/spec/views/ops/_rbac_group_details.html.haml_spec.rb
+++ b/spec/views/ops/_rbac_group_details.html.haml_spec.rb
@@ -58,20 +58,27 @@
       expect(rendered).to include('Look up LDAPS Groups')
     end
 
-    it 'should show "Look up groups" checkbox and label for auth mode amazon' do
+    it 'should not show "Look up groups" checkbox and label for auth mode amazon' do
       stub_settings(:authentication => { :mode => 'amazon' }, :server => {})
       render :partial => 'ops/rbac_group_details'
-      expect(rendered).to have_selector('input#lookup')
-      expect(rendered).to include('Look up Amazon Groups')
+      expect(rendered).not_to have_selector('input#lookup')
+      expect(rendered).not_to include('Look up Amazon Groups')
     end
 
     it 'should show "Look up groups" checkbox and label for auth mode httpd' do
-      stub_settings(:authentication => { :mode => 'httpd' }, :server => {})
+      stub_settings(:authentication => { :mode => 'httpd', :saml_enabled => false}, :server => {})
       render :partial => 'ops/rbac_group_details'
       expect(rendered).to have_selector('input#lookup')
       expect(rendered).to include('Look up External Authentication Groups')
     end
 
+    it 'should not show "Look up groups" checkbox and label for auth mode httpd with SAML enabled' do
+      stub_settings(:authentication => { :mode => 'httpd', :saml_enabled => true}, :server => {})
+      render :partial => 'ops/rbac_group_details'
+      expect(rendered).not_to have_selector('input#lookup')
+      expect(rendered).not_to include('Look up External Authentication Groups')
+    end
+
     it 'should not show "Look up groups" checkbox and label for auth mode database' do
       stub_settings(:authentication => { :mode => 'database' }, :server => {})
       render :partial => 'ops/rbac_group_details'