# Two Discourses with SSO: avoid admin/moderator sync
**URL:** https://meta.discourse.org/t/two-discourses-with-sso-avoid-admin-moderator-sync/115146
**Category:** Support
**Created:** [April 15, 2019, 7:02pm UTC](https://meta.discourse.org/t/two-discourses-with-sso-avoid-admin-moderator-sync/115146 "2019-04-15T19:02:09Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [April 15, 2019, 7:02pm UTC](https://meta.discourse.org/t/two-discourses-with-sso-avoid-admin-moderator-sync/115146/1 "2019-04-15T19:02:09Z")
We have two Discourses set up, where one uses SSO against the other one.
However, we do not want to synchronize admin and moderator privs, but they are synced every time a user logs in on the SSO client forum.
`sso_overrides_groups` has been disabled. It does not seem to work for admin and moderator privileges, when I look at the code those are implemented separately ([https://github.com/discourse/discourse/blob/master/app/models/discourse\_single\_sign\_on.rb#L78-L102](https://github.com/discourse/discourse/blob/master/app/models/discourse_single_sign_on.rb#L78-L102))
Is this by design, or is this a bug? Does anyone know a way around this?
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [April 15, 2019, 11:44pm UTC](https://meta.discourse.org/t/two-discourses-with-sso-avoid-admin-moderator-sync/115146/2 "2019-04-15T23:44:17Z")
Any thoughts on this @sam?
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [April 16, 2019, 12:07am UTC](https://meta.discourse.org/t/two-discourses-with-sso-avoid-admin-moderator-sync/115146/3 "2019-04-16T00:07:39Z")
We are going to need 2 extra site settings here:
>
```plaintext
sso_provider_include_groups
sso_provider_include_staff_flags
```
I think the default is correct though.
---
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [September 4, 2019, 5:55pm UTC](https://meta.discourse.org/t/two-discourses-with-sso-avoid-admin-moderator-sync/115146/4 "2019-09-04T17:55:15Z")
Is a PR for this still welcome @sam ?
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [September 14, 2019, 11:04pm UTC](https://meta.discourse.org/t/two-discourses-with-sso-avoid-admin-moderator-sync/115146/5 "2019-09-14T23:04:04Z")
Yes, I support adding something here, it will clearly have to live on the consumer side. I do struggle a bit with naming though.
`sso_sync_staff`, `sso_sync_groups` maybe? Trouble with `sso_sync_groups` is that there is naming clash with sso\_overrides\_groups.
So maybe instead we go with `sso_incoming_scopes` with a default of `staff,groups...` then you can select which incoming scopes you allow.
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [April 21, 2023, 6:35pm UTC](https://meta.discourse.org/t/two-discourses-with-sso-avoid-admin-moderator-sync/115146/6 "2023-04-21T18:35:03Z")
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [April 30, 2023, 10:22am UTC](https://meta.discourse.org/t/two-discourses-with-sso-avoid-admin-moderator-sync/115146/7 "2023-04-30T10:22:22Z")