Support Google Cloud Identity in SCIM bridge

The SCIM bridge requested admin.directory.userschema.readonly during
OAuth consent, which is a Google Workspace-only entitlement. Cloud
Identity-only admins could not grant it, so the connect flow failed
before any sync ran. The scope was also unused: the provider only
calls Users.List, never the schemas, groups, or customers endpoints.

Trim the requested scopes down to admin.directory.user.readonly so
the integration works for Workspace and Cloud Identity (Free and
Premium) tenants. Switch Users.List to projection=full so standard
extended fields (Organizations, ExternalIds, Relations, Languages)
are populated on synced users; full projection does not require any
extra OAuth scope. Relabel the connector UI to "Google Workspace /
Cloud Identity" to reflect the broader support.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/iam/scim/bridge/provider/googleworkspace/oauth2_scopes.go

@@ -15,13 +15,16 @@
 package googleworkspace
 
 var (
-	// OAuth2Scopes are the Google Workspace OAuth2 scopes required by the
-	// SCIM provisioning bridge. The bridge reads users, user schemas, group
-	// members, and customer info from the Admin Directory API.
+	// OAuth2Scopes are the OAuth2 scopes required by the SCIM provisioning
+	// bridge to read users from the Admin Directory API. The scopes are
+	// intentionally limited to what the bridge actually consumes so the
+	// integration also works for Google Cloud Identity (Free or Premium)
+	// customers, not only Google Workspace customers. In particular,
+	// admin.directory.userschema is a Workspace-only entitlement (custom
+	// user fields are not available on Cloud Identity) and must not be
+	// requested here, otherwise Cloud Identity-only admins cannot complete
+	// the OAuth consent flow.
 	OAuth2Scopes = []string{
 		"https://www.googleapis.com/auth/admin.directory.user.readonly",
-		"https://www.googleapis.com/auth/admin.directory.userschema.readonly",
-		"https://www.googleapis.com/auth/admin.directory.group.member.readonly",
-		"https://www.googleapis.com/auth/admin.directory.customer.readonly",
 	}
 )

pkg/iam/scim/bridge/provider/googleworkspace/provider.go

@@ -68,7 +68,11 @@ func (p *Provider) ListUsers(ctx context.Context) (scimclient.Users, error) {
 	pageToken := ""
 
 	for {
-		call := adminService.Users.List().Customer("my_customer").MaxResults(500).Context(ctx)
+		call := adminService.Users.List().
+			Customer("my_customer").
+			MaxResults(500).
+			Projection("full").
+			Context(ctx)
 		if pageToken != "" {
 			call = call.PageToken(pageToken)
 		}