TL2 welcome message sent every time on SSO login

Contribute Bug

AI-generated summary

The discussion revolves around a bug where users receive the TL2 welcome notification every time they log in via SSO. The issue occurs when “Sync User Data” is enabled, and the SSO provider sets a group that has a lower trust level than the user’s current trust level.

RJG reported the bug, which has been present for over a year. nat attempted to reproduce the issue but was unsuccessful. RGJ shared notes from the original instance, suggesting that the SSO provider passed an empty groups field, and the affected users were members of another group that forced them to TL2.

RJG also provided alternative steps to reproduce the issue, involving a second group. nat acknowledged the notes and will revisit the issue soon.

1

The following is happening:

Some users are getting the TL2 welcome notification (“we promoted you up a trust level”) on every login.

This happens under the following circumstances:

  • SSO login is enabled where Discourse is the SSO client
  • “Sync User Data” is enabled in WP-Discourse so it issues a sync_sso call every time the user logs into Wordpress
  • sync_sso is setting a group that has a grant_trust_level which is lower than the current trust level of the user

This causes the trust levels for the user to be recalculated from the ground up and the welcome message to be sent every time.

6 Likes
9

Hey there,

Thanks for sharing this bug! I’ve attempted to reproduce this bug but am not able to do so locally, here’s what my setup looks like:

(Wordpress)

  • Set up wordpress user “Steaky” with email steaky@cat.com
  • add wpdc_custom_sso_params to set cats group to all users who sign in with $params['groups'] = 'cats';

(Discourse)

  • Create a user “Steaky” with email steaky@cat.com
  • Make Steaky trust_level_3 legitimately (not locked)
  • create group “cats” and set “Trust level automatically granted to members" to 2 for “cats”

Wordpress & Discourse connected :ok_hand: also :ballot_box_with_check: Sync user data.

(Discourse)

  • log Steaky in, gets redirected to Wordpress and signs in, redirected back to Discourse
  • (confirm that “cats” is set to Steaky)
  • Steaky does not see welcome message

^ repeat above with SiteSetting.discourse_connect_overrides_groups, same result.

I suspect you’ve got a more detailed setup going on. It would be great if you could share more details about the setup of your affected users:

  • Which other “Discourse Connect” site settings do you have turned on?
  • Are your affected users separately joining groups which may grant them certain trust levels?
  • Are your affected users trust level locked? What kind of groups are they in?
  • any other information that would be useful

Thanks!

4 Likes
10

This bug is over one year old and in the meanwhile the client moved away from Discourse, so I cannot fully reproduce this anymore. However, I always take extensive notes so I even have record of the SSO payloads from back then. I am unable to inspect any other settings and/or try to repro on that exact instance though.

Back to my notes. What happened was a bit different from what you are doing. The SSO was passing an empty groups field (just groups=). But the users in question were members of another group, unknown to the SSO provider, which was forcing its members to TL2.

Additionally, the TL2 and TL3 welcome messages act differently as far as I recall, so you might have to use TL2 instead of TL3 if you attempt to reproduce this.

So to reproduce, I think you need to do the following: (note that I introduced a second group)

(Wordpress)

  • Set up wordpress user “Steaky” with email steaky@cat.com
  • add wpdc_custom_sso_params to set dogs group to all users who sign in with $params['groups'] = 'dogs';

(Discourse)

  • Create a user “Steaky” with email steaky@cat.com
  • Make Steaky trust_level_1 legitimately (not locked)
  • create group “cats” and “dogs” and set “Trust level automatically granted to members" to 2 for “cats”
  • make Steaky member of group cats
2 Likes
11

Have you been able to look into this issue any further?

1 Like
12

I’ve paused exploring that bug since my last response, but I’ve read and I’m appreciative of your notes! Quite incredible that you’ve got such a nice log of it. It’s still on my plate and I’ll be getting back to it soon, so thank you for checking in. :smiley:

3 Likes