Hi @angus! I’m curious if you’ve made any further progress on this? I’m very interested in the simple “strict” behavior, as I understand it, and since we control our Oauth2/OpenID connect provider, I’m not worried about the “secondary authorization” case. Any chance that something like that could land sooner?
If it’s any help, our environment is documented here: Infrastructure/Authentication - Fedora Project Wiki, and I’ve configured DIscourse to request oauth2 scope openid profile email https://id.fedoraproject.org/scope/groups
Basically, all I want is:
- Leave the trust level and staff groups alone
- Add the user to any existing Discourse groups in the list from SSO that are in the list if they’re not there already
- Remove the user from any groups they are in that aren’t in the list
I freely admit I don’t understand all the intricacies… is there a complication I don’t understand?