Question about the `--google-admin` flag

[John Spencer]

Is your feature request related to a problem? Please describe.
Missing / unclear documentation about the --google-admin flag

Describe the solution you'd like
Hello! First off, thank you so much for this amazing project. I was able to get it up and running fairly quickly, the documentation is quite good! I'm wondering about the --google-admin flag. Why is it needed, and what is it used for? I was surprised it was needed since I thought the service account credentials are used for authenticating to all things Google. Would you mind helping me understand what it's used for? The docs say it needs be an admin, but what admin permissions are needed (e.g. Services Admin, or Groups Admin)? Thank you in advance for the help! 🙏

[Chris Pates]

So this is a common practice with many tools that use the admin api, GAM for example does the same. I've not personally dug into this too deeply myself but I believe it is used to identify the tenant or domain within the Google platform.

The permissions are associated with the api client token, and privileges of the user are not used by ssosync.

[John Spencer]

Thanks for the context Chris! For any future readers, I had to give this google user the Groups Admin role in order for the sync to succeed. I tried Groups Reader but got a 403. Not sure if there's a more limited set of permissions, but this is what I was able to make work.