diff --git a/keystone_tempest_plugin/config.py b/keystone_tempest_plugin/config.py
index d3e3c02..25964a8 100644
--- a/keystone_tempest_plugin/config.py
+++ b/keystone_tempest_plugin/config.py
@@ -58,6 +58,12 @@
                default='federated_domain',
                help='The domain name where the "mapping_group_name" is '
                     'created.'),
+    # TODO(cmurphy): remove this option and set to true when all supported
+    # branches support the openstack_groups feature
+    cfg.BoolOpt('enable_k2k_groups_mapping',
+                default=False,
+                help='Whether to test support for openstack_groups in the K2K '
+                     'SAML assertion (lp#1687593)'),
 
     # Protocol
     cfg.StrOpt('protocol_id',
diff --git a/keystone_tempest_plugin/tests/scenario/test_federated_authentication.py b/keystone_tempest_plugin/tests/scenario/test_federated_authentication.py
index bb06748..a99118d 100644
--- a/keystone_tempest_plugin/tests/scenario/test_federated_authentication.py
+++ b/keystone_tempest_plugin/tests/scenario/test_federated_authentication.py
@@ -260,6 +260,9 @@
                                                             url.netloc)
 
     def _setup_mapping(self):
+        if not CONF.fed_scenario.enable_k2k_groups_mapping:
+            super(TestK2KFederatedAuthentication, self)._setup_mapping()
+            return
         self.mapping_id = data_utils.rand_uuid_hex()
         rules = [{
             'local': [