# הרמה טכנית של העברת דיסקורס ברשימה לבנה ל-SSO

**URL:** <https://meta.discourse.org/t/technical-lift-of-migrating-whitelisted-discourse-to-sso/214196>\
**Category:** General\
**Created:** [7 בינואר,‏ 2022,‏ 8:27pm UTC](https://meta.discourse.org/t/technical-lift-of-migrating-whitelisted-discourse-to-sso/214196 "2022-01-07T20:27:06Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![erikds](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/erikds/32/245561_2.png) [@erikds](https://meta.discourse.org/u/erikds)\
**Post date:** [7 בינואר,‏ 2022,‏ 8:27pm UTC](https://meta.discourse.org/t/technical-lift-of-migrating-whitelisted-discourse-to-sso/214196/1 "2022-01-07T20:27:06Z")

</div>

I’m considering using discourse for a discussion board for several thousand people (though never all at once) to replace a facebook group. The primary reason for this (aside from superior UX) is to control access to the board. My question is one of how we can control that access:

1. Ideally we would start with a local login, with account creation controlled by a whitelist set by admins. We would also want to periodically update the whitelist and prune members who should no longer have access.
2. in the future we may have our own SSO service where a user group or role provided by the SSO/OpenID Connect would be the source of truth on whether a user can have access. At this point we would want to remove the other login option. It seems like users could just add to their existing account a new connection for that SSO with the same email once configured.
3. Related to the above, wondering whether categories can be made private based on oidc role or group.

Sorry if this is probably covered in some of the docs, but i’m a little new to the ins and outs of this area and am mostly wondering whether these are well-trod paths for a small team of volunteer engineers and admins.

---

<div class="post-metadata">

**Author:** ![mattdm](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/mattdm/32/216484_2.png) [@mattdm](https://meta.discourse.org/u/mattdm)\
**Post date:** [12 בינואר,‏ 2022,‏ 5:05am UTC](https://meta.discourse.org/t/technical-lift-of-migrating-whitelisted-discourse-to-sso/214196/2 "2022-01-12T05:05:40Z")

</div>

Right now, there is no group sync support for oidc.

> [@Does \`sso overrides groups\` work with Oauth2?](https://meta.discourse.org/t/does-sso-overrides-groups-work-with-oauth2/175606):
>
> I would like to use this feature. We’re on the Business hosted plan, so SAML is not available to us, so we’re using Oauth2 / OpenID Connect. I believe I have everything configured correctly (sso overrides groups is on, and oauth2 scope is set to openid profile email https://id.fedoraproject.org/scope/groups). I am a little confused about how Discourse uses the word SSO and what options appear where. However, we’re using sso overrides username and that works. Should I expect this to as well?