I think I’ve finally figured out how to get Paid Memberships Pro to properly update group memberships with an SSO payload. My last problem was because I was careless about case of group names. And since I got the case wrong only once, it took me forever to find it.
Perhaps I should call this a feature request, but it cost me another 15 minutes to figure this one out, so I’m calling it a 
. 
https://github.com/discourse/discourse/blob/master/app/models/discourse_single_sign_on.rb#L113
