Hey everyone — but particuarly @ml_moderators and @magazine_editors! I want to turn on a feature which synchronizes Discourse group membership with FAS. That way, we aren’t keeping group membership in multiple places. As I understand it, this will destroy your existing manually-managed groups here, so we need to coordinate this. (See below.)
(Note that this won’t apply to the trust level groups, nor to staff, admin, and moderators.
I would love nothing more than to have Discourse membership come from FAS. (Really, the more things that can use FAS groups, the better - Taiga, Pagure, Matrix, etc etc etc)
Is there anything that would make the upcoming switch to the new account system problematic (i.e. should we wait until that is ready)?
I don’t think we need to wait on the new account system, as it’s mediated by Ipsilon.
Okay, so, one thing I just learned: the feature doesn’t actually create groups on this side. Which is actually good, because we can create them as we want to actually use them rather than getting a bunch of random groups like aws-billing created here.
But what it does mean is that we need a magazine-editors and ml-moderators group in FAS. Or, possibly, a discourse-mod-ml group so it’s sensibly named from a FAS point of view. Or, @ml_moderators, we could deprecate that group and just make all machine-learning-sig members moderators here.
Sounds great to me. The most I’ve ever done with groups is move people from ‘contributor’ to ‘author’. Just let me know how to do that on the new system if it is different. 
+1 from me. We have only ~7 members in the ML FAS group and I think they all will use the new power wisely.
Okay cool. It looks like we have some implementation work to do on the discourse side, but I’ll go ahead and rename the group here now so it’s ready. That just leaves it to the Magazine folks to decide if they want a Magazine Editors group in FAS. (That’s my suggestion!)
Yes please, and thank you! I am confused though. Is this already in place? How did we make it work? Was there a plugin?
It is not in place yet because it turns out Discourse doesn’t include this feature in their Oauth2 plugin (even though they could). See Does `sso overrides groups` work with Oauth2? - sso - Discourse Meta.
Current status: untested patches which might implement this behavior. Once we can test (which needs a staging environment), Patrick can submit these PRs for review, and then they might get implemented. Other option would be for Infrastructure to implement the DiscourseConnect SSO in Ipsilon and use that instead of Oauth2. Either one is kind of a small project. So while I’m still excited about this, it’s currently stalled.