Here is my current understanding of how we should organize Google workspace OIDC group mapping.

Process

• If "groups" is provided as a scope to the Google Goth provider, recursively search for groups the user belongs to
• Create a list of the groups and attach them to goth.User.RawData
• The following code was added to Gitea by Map OIDC groups to Orgs/Teams go-gitea/gitea#21441:

func getClaimedGroups(source *oauth2.Source, gothUser *goth.User) container.Set[string] {
	groupClaims, has := gothUser.RawData[source.GroupClaimName]
	if !has {
		return nil
	}

	return claimValueToStringSet(groupClaims)
}

TODO

• Where does source.GroupClaimName come from on the Goth side?
• Do we use group.Email or group.Name? (Reference)
• Authentication for admin service