Converting existing users to use Google Auth with a secondary email

Product Support SSO

AI-generated summary

ian937 seeks advice on migrating a private Discourse site with ~200 users from personal email signups to Google SSO, specifically forcing authentication via the organization’s Google domain. The goal is to avoid manual user intervention, which poses challenges for non-technical volunteers, and to prevent users from authenticating with personal Google accounts.

The proposed plan involves:

  1. Adding the organization’s Google email addresses as secondary emails for existing users.
  2. Configuring OAuth2 credentials in Admin > Login & Authentication and enabling Google OAuth2 logins.
  3. Restricting authentication to the organizational domain using the Allowed email domains setting.

To streamline the process, ian937 shares a Ruby script suggested by Google’s AI. This script reads a CSV mapping of personal emails to domain emails, finds the corresponding user, and automatically creates a confirmed secondary email entry if one does not already exist. The author requests validation of this approach, particularly regarding the necessity of the domain restriction setting and the safety of the script for production use.

1

We run a private Discourse site for our association with a little over 200 active users. Currently the vast majority are signed up with their personal email accounts rather than the Google account we create for them (because the Google accounts didn’t exist when we first setup Discourse, and a lot of people are more likely to check their personal email for notifications anyway).
Now I want to switch to using the Google accounts as the authentication source, but I want to try and avoid having to get users to manually change or add their google account emails themselves (because trying to get non-technical volunteers to do something like that always turns into a nightmare for me). I also want to avoid users with private google accounts using those for SSO, and force all users to SSO to our Google domain accounts.

Having done some Googling, I’ve come up with a possible plan to achieve this, but want to try and confirm that I’m on the right track. Here’s the plan:

  1. Add all the Google email addresses as secondary emails (I’ve already enabled Secondary email addresses in the settings)
  2. Setup an OAuth2 consent and credentials, as per the Discourse docs
  3. Enter the credentials in Admin > Login & Authentication > OAuth2, google oauth2 client id & google oauth2 client secret. Then enable the setting enable google oauth2 logins.
  4. Restrict authentication to our domain by setting Admin > Login & Authentication, Allowed email domains - is this necessary?

Also, Google’s AI suggested using this Ruby script to automate adding the email addresses:

require 'csv'

csv_path = "/shared/users_map.csv"
updated = 0
skipped = 0

CSV.foreach(csv_path) do |personal_email, domain_email|
personal_email = personal_email&.strip&.downcase
domain_email = domain_email&.strip&.downcase
next if personal_email.blank? || domain_email.blank?

user = User.find_by_email(personal_email)

if user.nil?
puts "NOT FOUND: #{personal_email}"
skipped += 1
next
end

if UserEmail.exists?(email: domain_email)
puts "ALREADY EXISTS: #{domain_email} (User: #{user.username})"
skipped += 1
next
end

Attach the domain email as a confirmed secondary email

UserEmail.create!(
user_id: user.id,
email: domain_email,
primary: false,
confirmed_at: Time.zone.now
)

puts "LINKED: #{user.username} -> #{domain_email}"
updated += 1
end

puts "\nDone! Updated: #{updated}, Skipped/Errors: #{skipped}"

Any feedback appreciated!