# Converting existing users to use Google Auth with a secondary email

**URL:** <https://meta.discourse.org/t/converting-existing-users-to-use-google-auth-with-a-secondary-email/417485>\
**Category:** SSO\
**Tags:** google-login\
**Created:** [15 בנובמבר,‏ 2026,‏ 10:48am UTC](https://meta.discourse.org/t/converting-existing-users-to-use-google-auth-with-a-secondary-email/417485 "2026-11-15T10:48:08Z")\
**Posts on this page:** 1\
**Page:** 1

## סיכום מבוסס בינה מלאכותית

[ian937](/t/-/417485/1) seeks advice on migrating a private Discourse site with ~200 users from personal email signups to Google SSO, specifically forcing authentication via the organization's Google domain. The goal is to avoid manual user intervention, which poses challenges for non-technical volunteers, and to prevent users from authenticating with personal Google accounts.

The proposed plan involves:
1. Adding the organization's Google email addresses as **secondary emails** for existing users.
2. Configuring OAuth2 credentials in **Admin > Login & Authentication** and enabling Google OAuth2 logins.
3. Restricting authentication to the organizational domain using the *Allowed email domains* setting.

To streamline the process, [ian937](/t/-/417485/1) shares a Ruby script suggested by Google's AI. This script reads a CSV mapping of personal emails to domain emails, finds the corresponding user, and automatically creates a confirmed secondary email entry if one does not already exist. The author requests validation of this approach, particularly regarding the necessity of the domain restriction setting and the safety of the script for production use.

<div class="post-metadata">

**Author:** ![ian937](https://avatars.discourse-cdn.com/v4/letter/i/839c29/32.png) [@ian937](https://meta.discourse.org/u/ian937)\
**Post date:** [15 בנובמבר,‏ 2026,‏ 10:48am UTC](https://meta.discourse.org/t/converting-existing-users-to-use-google-auth-with-a-secondary-email/417485/1 "2026-11-15T10:48:08Z")

</div>

We run a private Discourse site for our association with a little over 200 active users. Currently the vast majority are signed up with their personal email accounts rather than the Google account we create for them (because the Google accounts didn’t exist when we first setup Discourse, and a lot of people are more likely to check their personal email for notifications anyway).  
Now I want to switch to using the Google accounts as the authentication source, but I want to try and avoid having to get users to manually change or add their google account emails themselves (because trying to get non-technical volunteers to do something like that always turns into a nightmare for me). I also want to avoid users with private google accounts using those for SSO, and force all users to SSO to our Google domain accounts.

Having done some Googling, I’ve come up with a possible plan to achieve this, but want to try and confirm that I’m on the right track. Here’s the plan:

1. Add all the Google email addresses as secondary emails (I’ve already enabled Secondary email addresses in the settings)
2. Setup an OAuth2 consent and credentials, as per [the Discourse docs](https://meta.discourse.org/t/configure-google-login-for-discourse/15858?silent=true)
3. Enter the credentials in **Admin \> Login & Authentication \> OAuth2,** _google oauth2 client id_ & _google oauth2 client secret_. Then enable the setting _enable google oauth2 logins_.
4. Restrict authentication to our domain by setting **Admin \> Login & Authentication** , _Allowed email domains_ - is this necessary?

Also, Google’s AI suggested using this Ruby script to automate adding the email addresses:

```plaintext
require 'csv'

csv_path = "/shared/users_map.csv"
updated = 0
skipped = 0

CSV.foreach(csv_path) do |personal_email, domain_email|
personal_email = personal_email&.strip&.downcase
domain_email = domain_email&.strip&.downcase
next if personal_email.blank? || domain_email.blank?

user = User.find_by_email(personal_email)

if user.nil?
puts "NOT FOUND: #{personal_email}"
skipped += 1
next
end

if UserEmail.exists?(email: domain_email)
puts "ALREADY EXISTS: #{domain_email} (User: #{user.username})"
skipped += 1
next
end

Attach the domain email as a confirmed secondary email

UserEmail.create!(
user_id: user.id,
email: domain_email,
primary: false,
confirmed_at: Time.zone.now
)

puts "LINKED: #{user.username} -> #{domain_email}"
updated += 1
end

puts "\nDone! Updated: #{updated}, Skipped/Errors: #{skipped}"

```

Any feedback appreciated!