When a job is invoked from cron and the pam_group.so is configured to add supplementary groups it DOES NOT work as expected.

pam_group should provide membership based /etc/security/group.conf and it is working fine if you test with login or sudo.

After some tests I've compiled pam_group.so in DEBUG and I can confirm that pam_setcred in being called by cron and the module is adding the expected groups membership.

Then, checking do_command.c of cron I found there is need to call pam_setcred(pamh, PAM_REINITIALIZE_CRED | PAM_SILENT) after fork()
--- /usr/bin/editor:
/usr/bin/nano

--- /usr/bin/crontab:
-rwxr-sr-x 1 root crontab 43720 Feb 13  2020 /usr/bin/crontab

--- /var/spool/cron:
drwxr-xr-x 5 root root 4096 Jul 31  2020 /var/spool/cron

--- /var/spool/cron/crontabs:
drwx-wx--T 2 root crontab 4096 Mar  1 15:18 /var/spool/cron/crontabs

--- /etc/cron.d:
drwxr-xr-x 2 root root 4096 Feb 24 15:23 /etc/cron.d

--- /etc/cron.daily:
drwxr-xr-x 2 root root 4096 Feb  3 17:45 /etc/cron.daily

--- /etc/cron.hourly:
drwxr-xr-x 2 root root 4096 Jul 31  2020 /etc/cron.hourly

--- /etc/cron.monthly:
drwxr-xr-x 2 root root 4096 Jul 31  2020 /etc/cron.monthly

--- /etc/cron.weekly:
drwxr-xr-x 2 root root 4096 Feb  3 17:45 /etc/cron.weekly

The attached patch resolves this issue.

We believe that the bug you reported is fixed in the latest version of
cron, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 983817@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Georges Khaznadar <georgesk@debian.org> (supplier of updated cron package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 04 Jul 2022 09:37:15 +0200
Source: cron
Architecture: source
Version: 3.0pl1-145
Distribution: unstable
Urgency: medium
Maintainer: Javier Fernández-Sanguino Peña <jfs@debian.org>
Changed-By: Georges Khaznadar <georgesk@debian.org>
Closes: 773095 983817
Changes:
 cron (3.0pl1-145) unstable; urgency=medium
 .
   * included Jorge Rocha Gualtieri's patch, and shifted the change
     by many lines (closes: #983817)
   * moved part of debian/cron.postrm to debian/cron-daemon-common.postrm,
     added a condition in debian/cron-daemon-common.postrm: systemd-cron
     must not be installed, to let it remove /etc/cron.allow and
     /etc/cron.deny (closes: #773095)
Checksums-Sha1:
 71e17300a4ba3e64c71c1de5232048190a41c905 2114 cron_3.0pl1-145.dsc
 2edf61e3866a9e9fb55d7c0f9f10a534602a5f3f 111012 cron_3.0pl1-145.debian.tar.xz
 1b2f29737ea810f93408ff5ac8810cc7d2dda9fc 5898 cron_3.0pl1-145_source.buildinfo
Checksums-Sha256:
 ae52cc42de974ccd4a2c0b42cb7a4f11bf81cdb4531f8c98b91ca51aacaa57c1 2114 cron_3.0pl1-145.dsc
 6e4bd307b790068424a0a8c608208571f44c73383b2908fc7642845e2a3b44b8 111012 cron_3.0pl1-145.debian.tar.xz
 3d5d4ee940502eb61f2834467aa688aaaa7c9c1821aafac79fd9f49457b9d2dd 5898 cron_3.0pl1-145_source.buildinfo
Files:
 f7beea7308e5b91afc126bcedd45601f 2114 admin important cron_3.0pl1-145.dsc
 5ffc5ad09b6cdf2c49994377ae3329dd 111012 admin important cron_3.0pl1-145.debian.tar.xz
 cbd48157058b914905ceedb4504898a7 5898 admin important cron_3.0pl1-145_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJIBAEBCAAyFiEEM0CzZP9nFT+3zK6FHCgWkHE2rjkFAmLHIUkUHGdlb3JnZXNr
QGRlYmlhbi5vcmcACgkQHCgWkHE2rjmephAAi1Vt+uPLgB808BdCoZpXOnHcAnlE
nvjLUobSJVedTRbWZGQzjBF1eTWMyxfICEu0vp6Q+hJPEbYEzqCYrPRqaWlE55Yi
Ywgjyy4l+CmxdoYkzndEN2UKQHJUqsOAoPqH7uvf3UiPQhq9abIz3Ws13JDM13bW
FjdxQUPbbP4c4Jzi3qse7gXP1dlDCDKaooEkclmgv/qErnrvCQkpc6G4NgvqFHF/
D7FyzxI53jg4cvM8IJ269ujkjJ9J2pYf4H+oDuzgrEuY2DkkNgwDsdn2LoPFrvdO
m+UQRm25b3mH8zR7s/fKsd5C7vgoavub5nnGSGAlUgRpMkn8WKL882DNWlMVXaN/
wORYI2Th6uQPdSjGo2yIP0pEYT+EX3NEUxmyxz/xwv3s6esjsrdw5lhb8wW+OUF3
k+b/do3WB+LTZFwowK0p+BK0SN5LnxKpl4g71woZoNbF7tWmOUeFh/GfwhPwkPtf
t80y9+MW1aiimwTQ44HsCmEM6zQSYxBiWe4T4W3f+F12hTmDMZUZtZnBSOFo7qrf
DIVTL1pXll1XwGikaKSUOll3mLKJuoFX7iAJlB3ADkoa/npG+Ge9Ipv45zkLY4FV
ZsG3e5o/UWiQADp3BRREw8vMcW5YEUNI7GrrC8b0pilWmg49taXHxKU//pblBs5V
d90qeaoejFQiCUA=
=p5T7
-----END PGP SIGNATURE-----