In the GitOps SSO docs for Dex, the groups configuration at (2) is wrongly documented.

It reads

The groups property assigns users to one group or all groups in the groups list.

But the groups setting is a constraint, not a configuration, so should read:

If groups is set, only users who are part of the specified group(s) will be allowed to log in.

Dex does not perform assignment of users to groups.