# Public ip access only to selected category
**URL:** https://meta.discourse.org/t/public-ip-access-only-to-selected-category/107611
**Category:** Development
**Created:** [1월 26, 2019, 5:45오후 UTC](https://meta.discourse.org/t/public-ip-access-only-to-selected-category/107611 "2019-01-26T17:45:38Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@adopilot](https://meta.discourse.org/u/adopilot)
#### Post date: [1월 26, 2019, 5:45오후 UTC](https://meta.discourse.org/t/public-ip-access-only-to-selected-category/107611/1 "2019-01-26T17:45:38Z")
In our company Discourse is major communication tool for intranet communication.
Preventing from data leak we are hosting Discource on private network which is accessible only from intranet networks. There is some cases when we will like to gain public access for users, so they can post technical support questions, upload pictures directly from mobile , check PMs and something like this, but we also want to keep private themes in others categories which should be accessible only from company desktop hosts.
My questions are:
- Is this realizable by creating plugin ?
- How hard will be to write plugin for fire-walling off certains categories ? (any suggestion for budget
- Can this be done on proxy layer , hacking ngnx
- Is there any way to have 2x instance of Discourse and one db so public instance can access only to public category, while private instance can access to all categories ?
- Any other approach ?
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [1월 26, 2019, 7:16오후 UTC](https://meta.discourse.org/t/public-ip-access-only-to-selected-category/107611/2 "2019-01-26T19:16:49Z")
Discourse already has strong access control per-category based on groups.
What would a plugin add? It sounds like you’re reinventing the wheel here.
---
### Author:  [@adopilot](https://meta.discourse.org/u/adopilot)
#### Post date: [1월 26, 2019, 8:09오후 UTC](https://meta.discourse.org/t/public-ip-access-only-to-selected-category/107611/3 "2019-01-26T20:09:10Z")
Plugin will check does user requesting discorce from intranet (private) network or from internet (public) network and allow access secure categories
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [1월 26, 2019, 8:33오후 UTC](https://meta.discourse.org/t/public-ip-access-only-to-selected-category/107611/4 "2019-01-26T20:33:44Z")
If you created a plugin, you’d have to get the set of categories right. If you just configure Discourse to enforce those permissions, you’d still have to get the categories right. I’d argue that it’d be harder to get it right with a plugin. Discourse already shows a 🔒 next to protected categories.
---
### Author:  [@adopilot](https://meta.discourse.org/u/adopilot)
#### Post date: [1월 26, 2019, 8:42오후 UTC](https://meta.discourse.org/t/public-ip-access-only-to-selected-category/107611/5 "2019-01-26T20:42:24Z")
I have another idea to make this.
Since my discource getting users from my .net app over SSO
My .net app already watching is request public or private.
Two thing that I do not how to make.
Is there a way to my .net app in sso payload active change premisions for user.
It this cloud be done then my site can tell discource, this is unsceure user let him see only public categories.
Also is there a way to push Discourse requesting sso payload more often or every time source IP change on request or just to some how make discource log off user more often so they need to talk with SSO server
* * *
Apologies for spaming, but If i did not ask, I will never reailized the way.
My sso site can put members in grup and alos can remove from ir
> ### Specifying group membership
>
> You may specify group membership in your SSO payload using the `add_groups` and `remove_groups` attributes.
>
> `add_groups` is a comma delimited list of group names we will ensure the user is a member of.
> `remove_groups` is a comma delimited list of group names we will ensure the user is **not** a member of.
Only question I do not know is
How to tell discource to send users to login again.
Is there any settings to change so users are push to sing in again ?
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [1월 29, 2019, 9:41오전 UTC](https://meta.discourse.org/t/public-ip-access-only-to-selected-category/107611/6 "2019-01-29T09:41:37Z")
> [@adopilot](#):
>
> Is there any settings to change so users are push to sing in again ?
There are a few options you have, but the simplest would be to log everyone off once after you implement this.