Managing group membership via authentication

[david (David Taylor)]

For the record: group sync is now available for OIDC. For more information, check the plugin topic, and the recent changelog.

@Discourse

Group sync

The plugin can automatically sync group memberships from your OpenID Connect provider to Discourse groups. On each login, the plugin will read the configured claim from the OIDC token and update the user’s group memberships accordingly. To enable group sync:

1. Configure your identity provider to return an array of groups in one of the claims. This must be an array of strings.
2. Set openid_connect_groups_claim to the name of the claim in the OIDC token that contains the user’s groups (e.g. cognito:groups). Once set, this will start to synchronise the information to Discourse’s “Associated Groups” system.
3. Find the Discourse Group you’d like to link up. Go to “Settings” → “Membership” → “Automatic”, and then choose the Associated Groups to link up. This dropdown list is populated by information from the identity provider, so at least one group member must have logged in for an option to appear.