# Users losing group status?
**URL:** https://meta.discourse.org/t/users-losing-group-status/96790
**Category:** WordPress
**Created:** [September 9, 2018, 2:09pm UTC](https://meta.discourse.org/t/users-losing-group-status/96790 "2018-09-09T14:09:59Z")
**Posts on this page:** 17
**Page:** 1
### Author:  [@Edward\_Weiss](https://meta.discourse.org/u/Edward_Weiss)
#### Post date: [September 9, 2018, 2:09pm UTC](https://meta.discourse.org/t/users-losing-group-status/96790/1 "2018-09-09T14:09:59Z")
Hi all,
I’m currently using Discourse as a successor to a MailMan listserv. It’s been working very well so far. Membership is handled through a Wordpress site and the PaidMembershipsPro plugin. Group membership is sent through the SSO payload. So far, so good.
Some users have been finding that they stop receiving emails every so often, and when I check their account status, their group membership has disappeared. Nothing has changed on the Wordpress end.
I’m not sure what might be causing this, or where should I look to try to solve the problem. Any suggestions?
---
### Author:  [@anon48433008](https://meta.discourse.org/u/anon48433008)
#### Post date: [September 9, 2018, 8:50pm UTC](https://meta.discourse.org/t/users-losing-group-status/96790/2 "2018-09-09T20:50:25Z")
> [@Edward\_Weiss](#):
>
> Some users have been finding that they stop receiving emails every so often,
Doubt it helps but couldn’t hurt to mention
I see random system action revoking email in our logs
---
### Author:  [@Edward\_Weiss](https://meta.discourse.org/u/Edward_Weiss)
#### Post date: [September 9, 2018, 9:15pm UTC](https://meta.discourse.org/t/users-losing-group-status/96790/3 "2018-09-09T21:15:50Z")
I expect that happens when emails are bounced, but I don’t think it explains losing group status.
---
### Author:  [@anon48433008](https://meta.discourse.org/u/anon48433008)
#### Post date: [September 9, 2018, 10:05pm UTC](https://meta.discourse.org/t/users-losing-group-status/96790/4 "2018-09-09T22:05:22Z")
> [@Edward\_Weiss](#):
>
> I expect that happens when emails are bounced, but I don’t think it explains losing group status.
No, it does not explain that, in my case I was able to ask people if they were getting emails and they didn’t seem to notice anything so…
wish you well 🕶
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [September 9, 2018, 11:26pm UTC](https://meta.discourse.org/t/users-losing-group-status/96790/5 "2018-09-09T23:26:28Z")
Enable verbose sso logging in Discourse settings and check the SSO payload in `/logs`.
---
### Author:  [@Edward\_Weiss](https://meta.discourse.org/u/Edward_Weiss)
#### Post date: [September 13, 2018, 1:32am UTC](https://meta.discourse.org/t/users-losing-group-status/96790/6 "2018-09-13T01:32:58Z")
Thanks.
It looks like I’m getting some “nonce already expired” messages (as reported [here](https://meta.discourse.org/t/sporadic-issue-wp-discourse-sso-nonce-has-already-expired/94353/7) which seem to correspond to the users losing group status.
Any suggestions? I’ve had to disable group membership updates via SSO until this is sorted because I’ve gotten so many complaints!
---
### Author:  [@simon](https://meta.discourse.org/u/simon)
#### Post date: [September 13, 2018, 1:50am UTC](https://meta.discourse.org/t/users-losing-group-status/96790/7 "2018-09-13T01:50:41Z")
Are you using the [WP Discourse](https://github.com/discourse/wp-discourse) plugin for SSO? How are you adding the groups to the SSO payload?
Do you have the `sso overrides groups` Site Setting enabled on Discourse? If that setting is enabled, group membership will be lost for a user if a group isn’t specified in the SSO payload.
---
### Author:  [@Edward\_Weiss](https://meta.discourse.org/u/Edward_Weiss)
#### Post date: [September 13, 2018, 2:03am UTC](https://meta.discourse.org/t/users-losing-group-status/96790/8 "2018-09-13T02:03:53Z")
Yes, we’re using WP-Discourse. Groups are added through a custom script (using `add_filter( 'wpdc_sso_params', 'wpdc_custom_sso_params' );)` that checks membership status and changes the `add_groups` and `remove_groups` parameters based on the results.
sso\_overrides\_groups is disabled
---
### Author:  [@simon](https://meta.discourse.org/u/simon)
#### Post date: [September 13, 2018, 3:58am UTC](https://meta.discourse.org/t/users-losing-group-status/96790/9 "2018-09-13T03:58:26Z")
> [@Edward\_Weiss](#):
>
> It looks like I’m getting some “nonce already expired” messages (as reported [here](https://meta.discourse.org/t/sporadic-issue-wp-discourse-sso-nonce-has-already-expired/94353/7) which seem to correspond to the users losing group status.
This seems unlikely. When the nonce is expired the user should not be updated in any way. SSO login just fails.
Are you sure that the `add_groups` and `remove_groups` parameters are being set correctly? You can check this in your logs by filtering for ‘User was logged on’ and looking at the ‘info’ tab.
---
### Author:  [@Edward\_Weiss](https://meta.discourse.org/u/Edward_Weiss)
#### Post date: [September 13, 2018, 12:47pm UTC](https://meta.discourse.org/t/users-losing-group-status/96790/10 "2018-09-13T12:47:33Z")
(You’re probably right about the expired nonce being a red herring, it doesn’t correspond consistently in the logs to the people who are losing group access.)
The add/remove parameters passed in the SSO payload seem to be setting correctly in the logs, which is even more confusing.
---
### Author:  [@simon](https://meta.discourse.org/u/simon)
#### Post date: [September 13, 2018, 5:44pm UTC](https://meta.discourse.org/t/users-losing-group-status/96790/11 "2018-09-13T17:44:29Z")
> [@Edward\_Weiss](#):
>
> The add/remove parameters passed in the SSO payload seem to be setting correctly in the logs, which is even more confusing.
Have you have enabled the ‘Create or Sync Discourse Users on Login’ option (found on the [WP Discourse](https://github.com/discourse/wp-discourse) SSO Provider tab)? If so, an SSO payload is also sent when a user logs into your WordPress site. This payload also hooks into the `wpdc_sso_params` filter. Unfortunately, the results of this call to Discourse are not logged.
I’m going to make a small change to the [WP Discourse](https://github.com/discourse/wp-discourse) code today so that the call made when ‘Create or Sync Discourse Users on Login’ is enabled does not happen if the request originates from Discourse.
---
### Author:  [@Edward\_Weiss](https://meta.discourse.org/u/Edward_Weiss)
#### Post date: [September 13, 2018, 7:03pm UTC](https://meta.discourse.org/t/users-losing-group-status/96790/12 "2018-09-13T19:03:53Z")
> [@simon](#):
>
> > [@Edward\_Weiss](#):
> >
> > The add/remove parameters passed in the SSO payload seem to be setting correctly in the logs, which is even more confusing.
>
> Have you have enabled the ‘Create or Sync Discourse Users on Login’ option (found on the [WP Discourse](https://github.com/discourse/wp-discourse) SSO Provider tab)? If so, an SSO payload is also sent when a user logs into your WordPress site. This payload also hooks into the `wpdc_sso_params` filter. Unfortunately, the results of this call to Discourse are not logged.
>
> I’m going to make a small change to the [WP Discourse](https://github.com/discourse/wp-discourse) code today so that the call made when ‘Create or Sync Discourse Users on Login’ is enabled does not happen if the request originates from Discourse.
Yes, this setting is enabled. That probably explains all the seemingly random SSO calls that I see in the logs.
Just for my information and education, could you explain why the change that you are proposing might help?
---
### Author:  [@simon](https://meta.discourse.org/u/simon)
#### Post date: [September 13, 2018, 7:37pm UTC](https://meta.discourse.org/t/users-losing-group-status/96790/13 "2018-09-13T19:37:03Z")
> [@Edward\_Weiss](#):
>
> Just for my information and education, could you explain why the change that you are proposing might help?
I’m not sure that it will help - my goal in making the change was to eliminate an unnecessary API call. The updated code (version 1.7.6) is available in the WordPress repo now.
> [@Edward\_Weiss](#):
>
> That probably explains all the seemingly random SSO calls that I see in the logs.
Yes, it actually _does_ create a log entry when a new user is created, but not when a user is updated. The log entry will begin with `Verbose SSO log: New User (user_id:`.
If you can share the code that you’re using to hook into the `wpdc_sso_params` filter, I can test it out.
---
### Author:  [@Edward\_Weiss](https://meta.discourse.org/u/Edward_Weiss)
#### Post date: [September 14, 2018, 2:24am UTC](https://meta.discourse.org/t/users-losing-group-status/96790/14 "2018-09-14T02:24:24Z")
> [@simon](#):
>
> If you can share the code that you’re using to hook into the `wpdc_sso_params` filter, I can test it out.
Knowing me, it will be a silly PHP mistake.
```
add_filter( 'wpdc_sso_params', 'wpdc_custom_sso_params' );
function wpdc_custom_sso_params( $params ) {
require_once( ABSPATH . 'wp-includes/pluggable.php' );
$user = wp_get_current_user();
if ( in_array( 'subscriber', (array) $user->roles ) ) {
$user_sub = 1;
}
if ( in_array( 'spectator', (array) $user->roles ) ) {
//using spectator role as a standin for verified user who is pending vetting for provider forum but needs access to other forums in the meantime
$user_spec = 1;
}
$add_groups = array();
$remove_groups = array();
if ( pmpro_hasMembershipLevel('1', $user->ID) && $user_sub = 1 ) {
$add_groups[] = 'Assessors';
} else {
$remove_groups[] = 'Assessors';
}
if ( pmpro_hasMembershipLevel('2', $user->ID) && $user_sub = 1) {
$add_groups[] = 'Providers';
} else if ( pmpro_hasMembershipLevel('2', $user->ID) && $user_spec = 1) {
$add_groups[] = 'Assessors';
}
else {
$remove_groups[] = 'Providers';
}
if (pmpro_hasMembershipLevel('3', $user->ID) || pmpro_hasMembershipLevel('4', $user->ID) || pmpro_hasMembershipLevel('6', $user->ID) ) {
$add_groups[] = 'Members';
} else {
$remove_groups[] = 'Members';
}
$params['add_groups'] = join( ',', $add_groups );
$params['remove_groups'] = join( ',', $remove_groups );
return $params;
}
```
---
### Author:  [@simon](https://meta.discourse.org/u/simon)
#### Post date: [September 14, 2018, 3:51am UTC](https://meta.discourse.org/t/users-losing-group-status/96790/15 "2018-09-14T03:51:09Z")
There are a couple of errors in the code. `$user_sub = 1` will always return `true`. It needs to be `==` or `===`.
Here’s the logic I think you want:
The Accessors group is for `subscribers` who have a membership level of ‘1’ or for `spectators` who have a membership level of ‘2’.
The Providers group is for `subscribers` who have a membership level of ‘2’.
The Members group is for any user who has a membership level of ‘3’, ‘4’, or ‘6’.
See if this code works. If users are still being removed from groups, you’ll need to look at the logic in the function and make sure it’s correct. Users will be removed from a group if they don’t meet the condition in the `if` statement.
```php
add_filter( 'wpdc_sso_params', 'wpdc_custom_sso_params', 10, 2 );
function wpdc_custom_sso_params( $params, $user ) {
$add_groups = array();
$remove_groups = array();
$user_sub = in_array( 'subscriber', $user->roles );
$user_spec = in_array( 'spectator', $user->roles );
if ( ( pmpro_hasMembershipLevel( '1', $user->ID ) && $user_sub ) || ( pmpro_hasMembershipLevel( '2', $user->ID ) && $user_spec ) ) {
$add_groups[] = 'Assessors';
} else {
$remove_groups[] = 'Assessors';
}
if ( pmpro_hasMembershipLevel( '2', $user->ID ) && $user_sub ) {
$add_groups[] = 'Providers';
} else {
$remove_groups[] = 'Providers';
}
if ( pmpro_hasMembershipLevel( '3', $user->ID ) || pmpro_hasMembershipLevel( '4', $user->ID ) || pmpro_hasMembershipLevel( '6', $user->ID ) ) {
$add_groups[] = 'Members';
} else {
$remove_groups[] = 'Members';
}
$params['add_groups'] = join( ',', $add_groups );
$params['remove_groups'] = join( ',', $remove_groups );
return $params;
}
```
---
### Author:  [@Edward\_Weiss](https://meta.discourse.org/u/Edward_Weiss)
#### Post date: [September 14, 2018, 12:32pm UTC](https://meta.discourse.org/t/users-losing-group-status/96790/16 "2018-09-14T12:32:05Z")
Thanks so much, I’ll give it a try!
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [October 14, 2018, 12:46pm UTC](https://meta.discourse.org/t/users-losing-group-status/96790/17 "2018-10-14T12:46:40Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.