Google OIDC doesn't support groups scope

[tomwardill-payoneer]

The OIDC provider for Google doesn't support the groups scope` and will prevent login using an OAuth flow if it is requested:

Some requested scopes were invalid. {valid=[openid, https://www.googleapis.com/auth/userinfo.profile], invalid=[groups]} 

I'm not sure if the groups concept is fundamental, or it can somehow be empty if Google is used, or if there is an alternative.

[leg100]

No, not fundamental. It can probably be dropped. I think I had the idea that it could be used in future for synchronizing groups/teams. But if Google is anything to by, it is far from a de facto standard.

I'll either drop it or make the scopes configurable, or both.

Thanks for the bug report. I'll fix it shortly.

[pat-s]

Interesting. I know some OIDC providers (e.g. Keycloak or Azure OIDC) which rely on the groups scope and for which we are using it actively to gather group information.
Quite surprising that Google even blocks it - is there any more information why this is happening? @tomwardill-payoneer

[tomwardill-payoneer]

@pat-s groups isn't part of the core spec, it's an optional part of the standard that not everyone implements. I wasn't able to find an official citation from google, but argoproj/argo-cd#1195 is the same issue.

Looks like there are some workarounds with either hidden scopes, or a differently named scoped: hashicorp/vault-plugin-auth-jwt#83

But as it stands, the raw groups scope request won't work.

@leg100 appreciate the quick fix, will have a look at this today.