Q: Linux group membership in Google Compute Engine when using OS Login I'm trying to have proper group memberships in a GCP Compute Engine instance using OS Login. Ideally, it'd respect the organization membership, but that doesn't seem to be happening.
User 1 has username xxx_org_com and belongs to groups 698704386 adm dip video plugdev lxd, while user 2 has username yyy_org_com and belongs to groups 1944936932 adm dip video plugdev lxd.
It's important to note that org.com is managed with Gsuite and these are GSuite authenticated users and not from a 3rd party data source like AD.
So without manually creating groups, I'm not sure how I can mark a folder group readable/writable without making it also world readable/writable.
What am I doing wrong or is this not a good use case for os-login?

A: Thanks for the clarification. The example below will use X and Y as the two groups.
A) Go to the home folder of xxx_org_com by running following command:
cd /home

Then verify the permissions of the folders:
ls -l 

The output will be of permissions of the folders within your home directory. See below example:

drwxrwx--- 22 X X 4096 Dec 6 23:16 X
drwxr-x--- 43 Y Y 4096 Dec 10 10:39 Y

B) If the "other" users have permissions r-x to both groups X and Y, it means that X can read and execute files inside Y and vice versa. If per se, you want the users in group X to have full privileges to home/X, you must give them write privileges as it is the only one missing.
This command will add the missing 'Write' permission to the group:
sudo chmod g+w /home/X

And running this command will remove the 'rwx' permissions from 'other' users for all directories inside "/home" folder:
sudo chmod o-rwx /home/*

Now user of group X cannot view the /home/Y anymore as it is listed as 'other' users who have no permissions on it anymore (removed in previous steps). Same goes the other way for users of group Y on home/X.
Now, users from X group have full privileges (rwx) over home/X directory as previously set. 
C) What we need now is to add users from 'Y group' to 'X group' so that users of Y group can access and use the /home/X directory fully. Run the following command to do so:
sudo usermod -aG X Y

Then verify if it worked by running groups Y command. You should see a printout of all groups 'Y' users belonging to and groups X should be among them.
Keep in mind that the Read/Write/Execute permissions on your groups might be different. If so, run the commands accordingly to your permissions.

A: You can use the Cloud Identity Groups API which lets you create a special class of group that you can map to external identities from outside of Google like Linux memberships. 
Enable the Cloud Identity Groups API from the API library. Once you enable the API, you must create a service account following the steps in the documentation. Once this is done, you can use methods in the REST API to construct and use identity groups.
External identity mapping will let you unify context and access control from multiple sources into a single solution. This will allow users to assign Linux access controls specific to groups of users in their organization. 
In order to import users and groups that are not already an external identity source, you must first create an identity source, then import user and group information into Cloud Identity. 
