title: Why is this obscure property necessary for Google Admin API to confirm that someone is a member of a Google Group?
body: <p>I stood up <a href="https://oauth2-proxy.github.io/oauth2-proxy/" rel="nofollow noreferrer">OAuth2-proxy</a> as a reverse proxy in front of my application, following <a href="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/oauth_provider/" rel="nofollow noreferrer">their instructions</a>. The reverse proxy uses Google accounts for authentication, and uses an existing Google Group for authorization, per those same instructions.</p>
  <p>Everything works for some lucky members of the group. Other cursed members of the group are refused access.</p>
  <p>Logs reveal that the Google Admin API is responding that each of the lucky emails is in fact a member of the group, but each of the cursed emails is errantly reported as not a member of the group.</p>
  <p>What is the difference between the lucky and the cursed? Examining <a href="https://console.cloud.google.com/iam-admin/groups/" rel="nofollow noreferrer">https://console.cloud.google.com/iam-admin/groups/</a> for my organization and project shows a table with a curious <strong>Type</strong> icon.</p>
  <p><a href="https://i.stack.imgur.com/XUO1Y.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/XUO1Y.png" alt="Member table with curious type icon" /></a></p>
  <p>All five of the group members with the icon are lucky: the Google API confirms they are members of the group. All four members without the icon are cursed.</p>
  <p>The type icon is associated with the type <strong>google.apps.cloudidentity.groups.vx.membership.type.user</strong>. The five lucky members all have this type. The four cursed members do not. What is this type? It is mentioned nowhere in the public internet, until this SO question is posted.</p>
  <p>Consider the two test emails <strong>freddiehubbard1971@yahoo</strong> and <strong>milesdavis1959@yahoo.com</strong>. Freddie and Miles were created at the same time. They are both Yahoo emails, with associated Google accounts. They are alike in every way, except somehow Freddie is lucky and Miles is cursed.</p>
  <p>How did Freddie get tagged with <strong>google.apps.cloudidentity.groups.vx.membership.type.user</strong> and Miles did not? And more importantly how can I ensure that the non-test members of the group are so tagged?</p>