# SSO groups without completely overriding
**URL:** https://meta.discourse.org/t/sso-groups-without-completely-overriding/166892
**Category:** Support
**Created:** [October 11, 2020, 1:33pm UTC](https://meta.discourse.org/t/sso-groups-without-completely-overriding/166892 "2020-10-11T13:33:24Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@sok777](https://meta.discourse.org/u/sok777)
#### Post date: [October 11, 2020, 1:33pm UTC](https://meta.discourse.org/t/sso-groups-without-completely-overriding/166892/1 "2020-10-11T13:33:24Z")
Is there a way to use groups via SSO without overriding all existing groups?
For example, I want to pass two types of membership groups from my external website - let’s say group\_a and group\_b.
However, I don’t want users to lose their current trust\_level group and also, some users have their own groups which then allows them to access a private category.
By reading forum posts here and the manual it seems that selecting the SSO groups will override and remove users from all existing groups, unless the SSO will pass their current groups too. That’s an issue, because it means I’ll have to manually update each user’s current group in the external site’s db.
Am I missing something here?
Many thanks folks.
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [October 11, 2020, 6:41pm UTC](https://meta.discourse.org/t/sso-groups-without-completely-overriding/166892/2 "2020-10-11T18:41:36Z")
> [@Setup DiscourseConnect - Official Single-Sign-On for Discourse (sso)](https://meta.discourse.org/t/setup-discourseconnect-official-single-sign-on-for-discourse-sso/13045/1):
>
> Aside from `groups` , you may also specify group membership in your SSO payload using the `add_groups` and `remove_groups` attributes regardless of the _sso overrides groups_ option.
>
> `add_groups` is a comma delimited list of group names we will ensure the user is a member of.
> `remove_groups` is a comma delimited list of group names we will ensure the user is **not** a member of.
The `add` and `remove` parameters do exactly what you need.
---
### Author:  [@sok777](https://meta.discourse.org/u/sok777)
#### Post date: [October 11, 2020, 8:27pm UTC](https://meta.discourse.org/t/sso-groups-without-completely-overriding/166892/3 "2020-10-11T20:27:41Z")
Thanks! so using the add\_groups would NOT override or remove the users from current groups? And I would still be able to manually create and allow groups?
---
### Author:  [@mattdm](https://meta.discourse.org/u/mattdm)
#### Post date: [January 8, 2021, 7:53pm UTC](https://meta.discourse.org/t/sso-groups-without-completely-overriding/166892/4 "2021-01-08T19:53:07Z")
If this is used, and a user is removed from the group on the SSO side but not added to the `remove_groups`, they’ll stay a member on the Discourse site, right?
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [January 8, 2021, 7:56pm UTC](https://meta.discourse.org/t/sso-groups-without-completely-overriding/166892/5 "2021-01-08T19:56:51Z")
What do you mean by “this”, `groups` or the individual `add_groups` and `remove_groups` ?
What are the exact params and endpoint you are calling?
---
### Author:  [@mattdm](https://meta.discourse.org/u/mattdm)
#### Post date: [January 8, 2021, 7:59pm UTC](https://meta.discourse.org/t/sso-groups-without-completely-overriding/166892/6 "2021-01-08T19:59:16Z")
The individual ones. I’m not actually doing anything yet, just trying to understand.
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [January 8, 2021, 8:10pm UTC](https://meta.discourse.org/t/sso-groups-without-completely-overriding/166892/7 "2021-01-08T20:10:06Z")
So, SSO usually happen during the login flow.
All the `groups`, `add_groups` and `remove_groups` parameters are optional, and deal with group membership.
This has nothing to do with having a valid user on the site. Unless you make all the site categories only readable by members of specific groups.
---
### Author:  [@mattdm](https://meta.discourse.org/u/mattdm)
#### Post date: [January 8, 2021, 8:23pm UTC](https://meta.discourse.org/t/sso-groups-without-completely-overriding/166892/8 "2021-01-08T20:23:30Z")
Sorry, let me rephrase. Let’s say we have 1200 groups in our SSO. If we want to have group membership synced with that without using `sso overrides groups`, if someone is a member of three groups, those three groups would need to be listed in `add_groups` and the 1197 others in `remove_groups` (just in case they were previously in one of those 1197 and have been removed)?
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [January 8, 2021, 8:31pm UTC](https://meta.discourse.org/t/sso-groups-without-completely-overriding/166892/9 "2021-01-08T20:31:11Z")
In your case, and assuming your don’t have other manual groups in the Discourse instance, you should **enable** the `sso overrides groups` site setting, and pass the 3 groups the user is currently a member of in the `groups` parameter of the SSO payload.
On login we will ensure that the user is a member of those 3 groups and not a member of every other manual group.
---
### Author:  [@mattdm](https://meta.discourse.org/u/mattdm)
#### Post date: [January 8, 2021, 8:33pm UTC](https://meta.discourse.org/t/sso-groups-without-completely-overriding/166892/10 "2021-01-08T20:33:56Z")
Ok, that brings me to this question: [What happens to trust level and staff groups when using sso overrides groups?](https://meta.discourse.org/t/what-happens-to-trust-level-and-staff-groups-when-using-sso-overrides-groups/175541) 🙂