How can I get a user's own groups with their token?

[JimW1]

In my .NET app I'm using Sign In with Google, and pass in these scopes 

openid email profile https://www.googleapis.com/auth/cloud-identity.groups.readonly https://www.googleapis.com/auth/groups

I get the user's JWT, and can get their groups with the admin API, but would like to avoid using that. Is there a way to get the user's groups using their own JWT? I tried calling something like this, but keep getting 401 or 400 since the doc is unclear about the parameters. 

https://cloudidentity.googleapis.com/v1/groups/-/memberships:searchTransitiveGroups?query=member_key_id == '{email}'

I tried using the DirectoryService, but that threw exceptions.

[JimW1]

I keep trying to dig into this. I can get the AccessToken and trying to call  `/memberships:searchTransitiveGroups` gets a 403 when trying to get the user's own groups. And trying to use an AccessToken with a DirectoryService call throws a permission exception.

[l1985]

Hi, did you have any luck with this? Have been playing around with the same issue for a couple of days. Would really like to avoid having to set up an admin credential if possible, but i can't see a way around it. Thanks.

[JimW1]

No luck. I have to use admin creds to get a user's groups