# Which permissions needed for a regular user to know to which groups he/she belongs?

**URL:** <https://community.developer.atlassian.com/t/which-permissions-needed-for-a-regular-user-to-know-to-which-groups-he-she-belongs/44874>\
**Category:** Bitbucket Cloud\
**Tags:** oauth2, groups\
**Created:** [February 1, 2021, 12:35pm UTC](https://community.developer.atlassian.com/t/which-permissions-needed-for-a-regular-user-to-know-to-which-groups-he-she-belongs/44874 "2021-02-01T12:35:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![RingoDeSmet](https://avatars.discourse-cdn.com/v4/letter/r/b5e925/32.png) [@RingoDeSmet](https://community.developer.atlassian.com/u/RingoDeSmet)\
**Post date:** [February 1, 2021, 12:35pm UTC](https://community.developer.atlassian.com/t/which-permissions-needed-for-a-regular-user-to-know-to-which-groups-he-she-belongs/44874/1 "2021-02-01T12:35:11Z")

</div>

Hello,

We are using the Bitbucket Cloud users & groups to authenticate via OAuth to a third party system. So BB Cloud is our identity provider. We are in the situation where workspace admins can login correctly but regular users not.

At the time of writing, there is no V2 counterpart API yet for user group management, see ticket BCLOUD-17103.

So, retrieving the groups needs to be done with this legacy V1 API:

> **[groups Endpoint | Bitbucket Cloud | Atlassian Support](https://support.atlassian.com/bitbucket-cloud/docs/groups-endpoint/#GET-a-list-of-groups)**
>
> The groups endpoint provides functionality for querying information about Bitbucket Cloud user groups, creating new ones, and updating or deleting membership.

This is indeed the call which happens in the OAuth connector:

> <https://github.com/concourse/dex/blob/master/connector/bitbucketcloud/bitbucketcloud.go#L423-L437>

As a Workspace Admin user, if I test this call with `curl`, using an App Password, I can successfully retrieve the list of groups.

Now the docs of the legacy V1 API mentions this:

> The caller must authenticate with administrative rights on the workspace or as a group member to view a group.

Every of our developers, who have accepted the workspace invite, is added to a group `developers` which has READ access to a few basic repositories and is added to a group linked to their team. Via the team group, they have WRITE access to some more repositories.

Being member in two groups, I would assume this is enough for the `or as a group member` part as defined in the docs.

However, any of these developers are not able to invoke the legacy API call. They get a `403 Forbidden`.

- Should the `account` and `team` auth scopes be enough for a regular user to find out about the groups he/she is a member of?
- Are more auth scopes required?
- Does this even work for a regular user?

Thanks,

Ringo

---

<div class="post-metadata">

**Author:** ![aagrawal2](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/aagrawal2/32/40775_2.png) [@aagrawal2](https://community.developer.atlassian.com/u/aagrawal2)\
**Post date:** [February 26, 2021, 8:00am UTC](https://community.developer.atlassian.com/t/which-permissions-needed-for-a-regular-user-to-know-to-which-groups-he-she-belongs/44874/5 "2021-02-26T08:00:13Z")

</div>

Hi @RingoDeSmet

I have reached out to our product team. They should get back to you soon.

Thanks.

---

<div class="post-metadata">

**Author:** ![DavisLee](https://avatars.discourse-cdn.com/v4/letter/d/dc4da7/32.png) [@DavisLee](https://community.developer.atlassian.com/u/DavisLee)\
**Post date:** [March 1, 2021, 11:46pm UTC](https://community.developer.atlassian.com/t/which-permissions-needed-for-a-regular-user-to-know-to-which-groups-he-she-belongs/44874/6 "2021-03-01T23:46:06Z")

</div>

Hi @RingoDeSmet!

In short, yes, there are more auth scopes required. If you look at a group page you can see near the top, one of the workspace permissions is “ **Administer workspace** Can update workspace settings and administer repositories” This is the permission level necessary in order to retrieve the list of groups for a workspace. This endpoint is not meant to be accessible if a user is part of a group with only read or write access to certain repositories. To further clarify on the wording “The caller must authenticate with administrative rights on the workspace or as a group member to view a group.” The second part pertaining to the group member should be read as “The caller must authenticate with administrative rights as a group member to view a group.” Meaning they still need administrative rights on the workspace given as a group permission.

Hope that helps,  
Davis