Answer
For the 'User' context-mapping attribute, use the user's Identity (their database/login identity) rather than their Directory ID, even in an SSO environment — Directory ID isn't the right value for this mapping. 'UserGroup' refers to the ordinary user-account user group value shown on the user's own record. A couple of practical gotchas worth checking if a mapping still doesn't apply after using the correct attribute: some environments need a literal space around the operator in the mapping expression (e.g. USERGROUP = '100' rather than squished together), and on some update levels the User Groups metadata cache can get stuck and needs to be manually cleared — bookmarking and running javascript:void(window.location.href = '/main/ifsapplications/web/server/clearmetadatacache?USERGROUPS=TRUE'); in the browser clears that specific cache. If context mappings still don't apply correctly after checking all of this, there have been known bugs in this area on specific update levels, so it's worth checking current release notes or raising a case referencing the exact mapping attribute involved.