Add model and migration

db/migrate/20190301095211_create_scim_oauth_access_tokens.rb

+class CreateScimOauthAccessTokens < ActiveRecord::Migration[5.0]
+  def change
+    create_table :scim_oauth_access_tokens do |t|
+      t.timestamps_with_timezone null: false
+      t.references :group, null: false, index: false
+      t.string "token", null: false
+
+      t.index [:group_id, :token], unique: true
+      t.foreign_key :namespaces, column: :group_id, on_delete: :cascade
+    end
+  end
+end

ee/app/controllers/groups/scim_oauth_controller.rb

+# frozen_string_literal: true
+
+class Groups::ScimOauthController < Groups::ApplicationController
+  before_action :require_top_level_group
+  before_action :authorize_manage_saml!
+  before_action :check_group_saml_available!
+  before_action :check_group_saml_configured
+
+  def show
+    @saml_provider = @group.saml_provider || @group.build_saml_provider
+  end
+
+  def create
+    @saml_provider = @group.build_saml_provider(saml_provider_params)
+
+    @saml_provider.save
+
+    render :show
+  end
+end

ee/app/models/scim_oauth_access_token.rb

+# frozen_string_literal: true
+
+class ScimOauthAccessToken < ActiveRecord::Base
+  include TokenAuthenticatable
+
+  belongs_to :group
+
+  add_authentication_token_field :token
+
+  validates :group, presence: true
+  before_save :ensure_token
+end

ee/spec/models/scim_oauth_access_token_spec.rb

+require 'spec_helper'
+
+describe ScimOauthAccessToken do
+  describe "Associations" do
+    it { is_expected.to belong_to :group }
+  end
+
+  describe 'Validations' do
+    it { is_expected.to validate_presence_of(:group) }
+  end
+
+  describe '#token' do
+    it 'generates a token on creation' do
+      scim_token = described_class.create(group: create(:group))
+
+      expect(scim_token.token).to be_a(String)
+    end
+  end
+end