userinfos = [m.getUser(user, groups=True) for user in args]

this will break against older hub

krb5_join = False

Making this join conditional seems fine, but unrelated. Was this prompted by anything?

joins = ['users g on g.id = user_groups.group_id']

minor nit. doesn't match the form of the other join. Let's go with the explicit AS and keep the sql keywords all caps.

clauses.append('user_id = %(info)i')

We should always use %s placeholders for our query params, as that is what psycopg2 wants.

fields = ['g.id', 'g.name']

maybe aliases?

return query.execute() or []

I don't think the or [] is needed. The execute() call should always return a list.

Also, at the moment, this is returning a list of dictionaries with some less friendly keys. getUser is passing this result through, but the cli code seems to assume a simple list of group names. I'm not sure which way you intended to go here.

I guess I'd lean toward returning the list of id/name data dicts and adjust the cli to handle that. If so, friendlier field aliases would be nice.

Also, we're re-implementing get_user_groups from auth.py a bit.

see also #3859

:thumbsup:

Commit 30846799 fixes this pull-request