diff --git a/roles/fedoauth/templates/fedoauth.cfg b/roles/fedoauth/templates/fedoauth.cfg
index 9241352565..1bd62956d1 100644
--- a/roles/fedoauth/templates/fedoauth.cfg
+++ b/roles/fedoauth/templates/fedoauth.cfg
@@ -19,8 +19,9 @@ AUTH_MODULE='fedoauth.auth.fas.Auth_FAS'
 # FAS PROVIDER CONFIGURATION
 FAS_USER_AGENT = 'FAS-OpenID'
 FAS_BASE_URL='https://admin.fedoraproject.org/accounts/'
-FAS_CHECK_CERT=False
-FAS_HTTPS_REQUIRED=False
+FAS_CHECK_CERT=True
+FAS_HTTPS_REQUIRED=True
+FAS_HANDLE_GROUPS_MAGIC_VALUE=True
 
 # Enable a filter to make this only available to a specific list of users
 FAS_AVAILABLE_FILTER = False
diff --git a/roles/fedoauth/templates/fedoauth.stg.cfg b/roles/fedoauth/templates/fedoauth.stg.cfg
index bd2bc27ca6..ee0da65e83 100644
--- a/roles/fedoauth/templates/fedoauth.stg.cfg
+++ b/roles/fedoauth/templates/fedoauth.stg.cfg
@@ -21,6 +21,7 @@ FAS_USER_AGENT = 'FAS-OpenID'
 FAS_BASE_URL='https://admin.fedoraproject.org/accounts/'
 FAS_CHECK_CERT=False
 FAS_HTTPS_REQUIRED=False
+FAS_HANDLE_GROUPS_MAGIC_VALUE=True
 
 # Enable a filter to make this only available to a specific list of users
 FAS_AVAILABLE_FILTER = False