Not only set, but also reset staff/superuser flags. Also, don't mix them.

2 files changed, 6 insertions, 1 deletions

diff --git a/README.md b/README.md
index 9d21c5a..fceef94 100644
--- a/README.md
+++ b/README.md
@@ -58,6 +58,8 @@ How to use it
 	_Django user will get superuser flag when Crowd user is in given Crowd group_
 	
 		AUTH_CROWD_SUPERUSER_GROUP = 'superuser'
+	Note that superuser group member does not imply staff membership and vice
+	versa (make sure you read Django docs to understand the difference).
     
 	_crowdrest will use this username and password to connect to Crowd server_
 	
diff --git a/crowdrest/backend.py b/crowdrest/backend.py
index ac01f89..7600906 100644
--- a/crowdrest/backend.py
+++ b/crowdrest/backend.py
@@ -114,10 +114,13 @@ class CrowdRestBackend(object):
         user.groups = group_objs
 
         if crowd_settings.AUTH_CROWD_SUPERUSER_GROUP in group_names:
-            user.is_staff     = True
             user.is_superuser = True
+        else:
+            user.is_superuser = False
         if crowd_settings.AUTH_CROWD_STAFF_GROUP in group_names:
             user.is_staff = True
+        else:
+            user.is_staff = False
 
     def get_user(self, user_id):
         "Return User instance of given identifier."