Empty groups[] with Google connector

[andrejvanderzee]

We are trying to use the Google connector. We are able to login, but we keep getting empty groups:

  "level": "info",
  "msg": "login successful: connector \"google\", username=\"AWS User\", preferred_username=\"\", email=\"[email protected]\", groups=[]",
  "time": "2022-09-06T18:23:31Z"
}

This is our Dex config:

  # Set it to a valid URL
  issuer: https://oidc.***.cloud

  # See https://dexidp.io/docs/storage/ for more options
  storage:
    type: kubernetes
    config:
      inCluster: true

  # Enable at least one connector
  # See https://dexidp.io/docs/connectors/ for more options
  # enablePasswordDB: true

  connectors:
  - type: google
    id: google
    name: Google
    config:

      issuer: "https://accounts.google.com"

      # Connector config values starting with a "$" will read from the environment.
      clientID: $GOOGLE_CLIENT_ID
      clientSecret: $GOOGLE_CLIENT_SECRET
  
      # Dex's issuer URL + "/callback"
      redirectURI: https://oidc.***.cloud/callback

      # Google supports whitelisting allowed domains when using G Suite
      # (Google Apps). The following field can be set to a list of domains
      # that can log in:
      #
      hostedDomains:
      - ***.io
  
      # The Google connector supports whitelisting allowed groups when using G Suite
      # (Google Apps). The following field can be set to a list of groups
      # that can log in:
      #
      groups:
      - vault-login@***.io
  
      # Google does not support the OpenID Connect groups claim and only supports
      # fetching a user's group membership with a service account.
      # This service account requires an authentication JSON file and the email
      # of a G Suite admin to impersonate:
      #
      serviceAccountFilePath: /etc/google/gserviceaccount.json
      adminEmail: admin@***.io

      fetchTransitiveGroupMembership: true
      
      staticClients:
      - id: vault
        name: HashiCorp Vault
        secret: ***
        redirectURIs:
        - http://localhost:8250/oidc/callback

So the Login works fine.

We have setup serviceAccountFilePath and adminEmail. The user we login is member of some groups, but it keeps giving [] from goups.

Any idea? Thanks!

[andrejvanderzee]

We have found that s.Scopes is false and hence no groups:

https://github.com/dexidp/dex/blob/master/connector/google/google.go#L221

[andrejvanderzee]

Looks like a bug: #2653