[DC] Google Workspace: users and groups on secondary domains silently excluded when both Domain and Customer ID are set; customer-only config rejected

[watchingdogs]

Steps To Reproduce

1. Have a Google Workspace account with a secondary domain (primary example.com, secondary example-two.com), with at least one user and one group whose addresses are on the secondary domain.
2. In Directory Connector, configure the Google Workspace directory service and fill in BOTH the Domain field (example.com) AND the Customer ID field (the account's customer ID), the settings screen offers both fields side by side.
3. Run a test sync ("Test Now" in the desktop app, or bwdc test in the CLI).
4. Observe the returned users and groups.
5. Additionally: clear the Domain field, keep Customer ID set, and run the test sync again.

Expected Result

• With Customer ID configured, the sync should return ALL users and groups across every domain of the Workspace account. Google's Directory API documentation recommends the customer parameter for multi-domain accounts: "if a customer has secondary domains, using the domain parameter only returns users with email addresses on that particular domain... we recommend using the customer parameter." Source
• A customer-only configuration should be accepted as valid, since the Directory API requires exactly one of domain / customer — either should suffice.

Actual Result

• When both fields are set, both parameters are sent to the Directory API, and the API gives domain precedence. Users AND groups on secondary domains are silently excluded from the sync, no warning or log message. Verified against a live multi-domain tenant: a test sync returned 7 of 8 users and 1 of 2 groups; the missing user and the missing group were exactly the ones addressed on the secondary domain.
• When only Customer ID is set (Domain empty), the sync fails with "Directory configuration incomplete.", GSuiteDirectoryService.auth() requires domain to be non-null regardless of customer.

Screenshots or Videos

No response

Additional Context

Root cause is in libs/services/directory-services/gsuite-directory.service.ts: auth() treats this.dirConfig.domain == null as fatal regardless of customer. Additionally, when both fields are set, both parameters are forwarded to the Directory API, which treats them as mutually exclusive and prefers domain, so which parameter takes effect is decided implicitly by the API rather than explicitly by the client.

Reproduced with the official 2026.6.1 CLI and a from-source build of current main; the desktop app shares the same service code. Platform-independent (verified on Windows).

I have a fix ready and would like to submit a PR: accept at least one of domain / customer in validation, and always send exactly one parameter, with domain keeping precedence when both are set, deliberately preserving the current effective sync scope of every existing configuration. The change is purely additive: customer-only configurations become possible; nothing changes for existing setups. Includes unit tests.

And also I am sorry for the heavy use of AI writing, I wanted this issue to be fixed as soon as possible, hopefully all of this is enough for getting a sense of the situation.

Operating System

Windows

Operating System Version

Windows 11

Directory Service

Google Workspace

Application Type

CLI (the bwdc command line application)

Build Version

2026.6.1

Issue Tracking Info

• I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

[bitwarden-bot]

Thank you for reporting this issue! We've added this to our internal tracking system.
ID: PM-40799
Link (for internal use): https://bitwarden.atlassian.net/browse/PM-40799