SSO groups without completely overriding

[sok777 (sok)]

Is there a way to use groups via SSO without overriding all existing groups?
For example, I want to pass two types of membership groups from my external website - let’s say group_a and group_b.
However, I don’t want users to lose their current trust_level group and also, some users have their own groups which then allows them to access a private category.

By reading forum posts here and the manual it seems that selecting the SSO groups will override and remove users from all existing groups, unless the SSO will pass their current groups too. That’s an issue, because it means I’ll have to manually update each user’s current group in the external site’s db.

Am I missing something here?
Many thanks folks.

[Falco (Rafael dos Santos Silva)]

@sam

Aside from groups , you may also specify group membership in your SSO payload using the add_groups and remove_groups attributes regardless of the sso overrides groups option.

add_groups is a comma delimited list of group names we will ensure the user is a member of.
remove_groups is a comma delimited list of group names we will ensure the user is not a member of.

The add and remove parameters do exactly what you need.

[sok777 (sok)]

Thanks! so using the add_groups would NOT override or remove the users from current groups? And I would still be able to manually create and allow groups?