Yeah this sounds somewhat similar to other extensions SSO already has. It is pretty rare to need this so I am on the fence 
about adding this to the protocol or not.
The webhook will work, you would get called on login, then you can make a second call to discourse to synchronize the list via our API.