From 7934c54f428b1670e0fe903504a3d206f7487871 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Aur=C3=A9lien=20Sibiril?= <81782+aureliensibiril@users.noreply.github.com> Date: Fri, 24 Apr 2026 21:03:07 +0200 Subject: [PATCH] Request Google customer directory scope for name sync MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The access-review source-name worker calls Customers.Get("my_customer") on the Google Admin SDK to resolve the Google Workspace primary domain. That endpoint requires admin.directory.customer.readonly; without it the request returns 403 and the source keeps the generic placeholder name. The scope is already requested by the SCIM bridge -- align the access-review driver with it. Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com> --- pkg/accessreview/drivers/oauth2_scopes.go | 1 + 1 file changed, 1 insertion(+) diff --git a/pkg/accessreview/drivers/oauth2_scopes.go b/pkg/accessreview/drivers/oauth2_scopes.go index b77b973f1..4a4fa8d29 100644 --- a/pkg/accessreview/drivers/oauth2_scopes.go +++ b/pkg/accessreview/drivers/oauth2_scopes.go @@ -31,6 +31,7 @@ var providerOAuth2Scopes = map[coredata.ConnectorProvider][]string{ coredata.ConnectorProviderGoogleWorkspace: { "https://www.googleapis.com/auth/admin.directory.user.readonly", "https://www.googleapis.com/auth/admin.directory.group.member.readonly", + "https://www.googleapis.com/auth/admin.directory.customer.readonly", }, // Notion and Intercom intentionally omitted: Notion uses extra-auth-params // instead of scopes, Intercom configures scopes at the app level.