两次与 SSO 的讨论：避免管理员/版主同步

支持
1

We have two Discourses set up, where one uses SSO against the other one.
However, we do not want to synchronize admin and moderator privs, but they are synced every time a user logs in on the SSO client forum.

sso_overrides_groups has been disabled. It does not seem to work for admin and moderator privileges, when I look at the code those are implemented separately (https://github.com/discourse/discourse/blob/master/app/models/discourse_single_sign_on.rb#L78-L102)

Is this by design, or is this a bug? Does anyone know a way around this?

2

Any thoughts on this @sam?

3

We are going to need 2 extra site settings here:

sso_provider_include_groups
sso_provider_include_staff_flags

I think the default is correct though.

4

@sam，现在提交此问题的 PR 还受欢迎吗？

5

是的，我支持在此处添加相关内容，它显然需要放在客户端。不过，我在命名上有些纠结。

sso_sync_staff、sso_sync_groups 怎么样？sso_sync_groups 的问题在于它与 sso_overrides_groups 存在命名冲突。

所以，也许我们可以改用 sso_incoming_scopes，默认值为 staff,groups...，然后你可以选择允许哪些传入范围。