# Converting existing users to use Google Auth with a secondary email

**URL:** <https://meta.discourse.org/t/converting-existing-users-to-use-google-auth-with-a-secondary-email/417485>\
**Category:** SSO\
**Tags:** google-login\
**Created:** [15 בנובמבר,‏ 2026,‏ 10:48am UTC](https://meta.discourse.org/t/converting-existing-users-to-use-google-auth-with-a-secondary-email/417485 "2026-11-15T10:48:08Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![ian937](https://avatars.discourse-cdn.com/v4/letter/i/839c29/32.png) [@ian937](https://meta.discourse.org/u/ian937)\
**Post date:** [15 בנובמבר,‏ 2026,‏ 10:48am UTC](https://meta.discourse.org/t/converting-existing-users-to-use-google-auth-with-a-secondary-email/417485/1 "2026-11-15T10:48:08Z")

</div>

We run a private Discourse site for our association with a little over 200 active users. Currently the vast majority are signed up with their personal email accounts rather than the Google account we create for them (because the Google accounts didn’t exist when we first setup Discourse, and a lot of people are more likely to check their personal email for notifications anyway).  
Now I want to switch to using the Google accounts as the authentication source, but I want to try and avoid having to get users to manually change or add their google account emails themselves (because trying to get non-technical volunteers to do something like that always turns into a nightmare for me). I also want to avoid users with private google accounts using those for SSO, and force all users to SSO to our Google domain accounts.

Having done some Googling, I’ve come up with a possible plan to achieve this, but want to try and confirm that I’m on the right track. Here’s the plan:

1. Add all the Google email addresses as secondary emails (I’ve already enabled Secondary email addresses in the settings)
2. Setup an OAuth2 consent and credentials, as per [the Discourse docs](https://meta.discourse.org/t/configure-google-login-for-discourse/15858?silent=true)
3. Enter the credentials in **Admin \> Login & Authentication \> OAuth2,** _google oauth2 client id_ & _google oauth2 client secret_. Then enable the setting _enable google oauth2 logins_.
4. Restrict authentication to our domain by setting **Admin \> Login & Authentication** , _Allowed email domains_ - is this necessary?

Also, Google’s AI suggested using this Ruby script to automate adding the email addresses:

```plaintext
require 'csv'

csv_path = "/shared/users_map.csv"
updated = 0
skipped = 0

CSV.foreach(csv_path) do |personal_email, domain_email|
personal_email = personal_email&.strip&.downcase
domain_email = domain_email&.strip&.downcase
next if personal_email.blank? || domain_email.blank?

user = User.find_by_email(personal_email)

if user.nil?
puts "NOT FOUND: #{personal_email}"
skipped += 1
next
end

if UserEmail.exists?(email: domain_email)
puts "ALREADY EXISTS: #{domain_email} (User: #{user.username})"
skipped += 1
next
end

Attach the domain email as a confirmed secondary email

UserEmail.create!(
user_id: user.id,
email: domain_email,
primary: false,
confirmed_at: Time.zone.now
)

puts "LINKED: #{user.username} -> #{domain_email}"
updated += 1
end

puts "\nDone! Updated: #{updated}, Skipped/Errors: #{skipped}"

```

Any feedback appreciated!

---

_[View the full topic](https://meta.discourse.org/t/converting-existing-users-to-use-google-auth-with-a-secondary-email/417485)._