I'm attempting to automate some activity based on email arrival.
We have our permissions tightly tied down via groups, and the various directory access blocks are based on group membership.

Since a process that does automation might need to access lots of different directories grouped on different groups, that process has to be run by a user with membership to multiple groups.

Which works fine from an internactive run.

But when triggered via .forward, group membership ONLY is in the primary group, ignoring all secondary groups.

How can I grant secondary group membership when running via .forward?

I've worked around it.

I currently have a perl script that does moth of my automation buy watching drop directories and "doing stuff" as needed.

It allows setting of the user to run as and executes the program via:
su -c "Command to run" User_To_Run_As

This allows full group(s) access.

I was hoping to avoid the setup portion (10 lines or so of a config file) but I bit the bullet.