I spent five or six weeks setting up Discourse’s SSO, and encountered some problems during this period. Now there is a problem that is blocking me. I will record this problem in as much detail as possible. Development environment ubuntu22 on vmware discourse 3.2.0.beta2-dev server runs on 127.0.0.1:3000 ember-cli runs on 127.0.0.1:4200 Install Discourse on Ubuntu or Debian for Development disabled plugins presence chat narrative bot Use plug-in Discourse OpenID Connect to connect kecloak based on OIDC, keycloak as the identity provider of discourse OIDC connection configuration on Discourse OpenID Connect openid connect discovery document: http://127.0.0.1:8080/realms/mediawiki-realm/.well-known/openid-configuration openid connect client id: mydiscourse openid connect client secret: O9A8zQuOn1bfpsWD89U8ULwYf6ooDu73 sso provider keycloak 22.0.4 runs on 127.0.0.1:8080 OIDC connection configuration on keycloak Valid redirect URIs: http://127.0.0.1:3000/auth/oidc/callback Client secret: O9A8zQuOn1bfpsWD89U8ULwYf6ooDu73 chrome version 118.0.5993.70 Reproduction process Log in with OIDC [image] Discourse redirects to keycloak, enter user information in keycloak [image] CSRF [image] Logs [image] // [image] // [image] // [image] // Application Trace lib/middleware/omniauth_bypass_middleware.rb:53:in `call' lib/content_security_policy/middleware.rb:12:in `call' lib/middleware/gtm_script_nonce_injector.rb:10:in `call' config/initializers/100-quiet_logger.rb:20:in `call' config/initializers/100-silence_logger.rb:29:in `call' lib/middleware/missing_avatars.rb:22:in `call' lib/middleware/turbo_dev.rb:31:in `call' // Framework Trace omniauth (1.9.2) lib/omniauth/failure_endpoint.rb:25:in `raise_out!' omniauth (1.9.2) lib/omniauth/failure_endpoint.rb:20:in `call' omniauth (1.9.2) lib/omniauth/failure_endpoint.rb:12:in `call' omniauth (1.9.2) lib/omniauth/strategy.rb:491:in `fail!' /home/hardway/Downloads/omniauth-oauth2/lib/omniauth/strategies/oauth2.rb:88:in `callback_phase' plugins/discourse-openid-connect/lib/omniauth_open_id_connect.rb:142:in `callback_phase' omniauth (1.9.2) lib/omniauth/strategy.rb:238:in `callback_call' omniauth (1.9.2) lib/omniauth/strategy.rb:189:in `call!' omniauth (1.9.2) lib/omniauth/strategy.rb:169:in `call' omniauth (1.9.2) lib/omniauth/strategy.rb:192:in `call!' omniauth (1.9.2) lib/omniauth/strategy.rb:169:in `call' omniauth (1.9.2) lib/omniauth/strategy.rb:192:in `call!' omniauth (1.9.2) lib/omniauth/strategy.rb:169:in `call' omniauth (1.9.2) lib/omniauth/strategy.rb:192:in `call!' omniauth (1.9.2) lib/omniauth/strategy.rb:169:in `call' omniauth (1.9.2) lib/omniauth/strategy.rb:192:in `call!' omniauth (1.9.2) lib/omniauth/strategy.rb:169:in `call' omniauth (1.9.2) lib/omniauth/strategy.rb:192:in `call!' omniauth (1.9.2) lib/omniauth/strategy.rb:169:in `call' omniauth (1.9.2) lib/omniauth/builder.rb:45:in `call' rack (2.2.8) lib/rack/tempfile_reaper.rb:15:in `call' rack (2.2.8) lib/rack/conditional_get.rb:27:in `call' rack (2.2.8) lib/rack/head.rb:12:in `call' actionpack (7.0.7) lib/action_dispatch/http/permissions_policy.rb:38:in `call' rack (2.2.8) lib/rack/session/abstract/id.rb:266:in `context' rack (2.2.8) lib/rack/session/abstract/id.rb:260:in `call' actionpack (7.0.7) lib/action_dispatch/middleware/cookies.rb:704:in `call' activerecord (7.0.7) lib/active_record/migration.rb:603:in `call' actionpack (7.0.7) lib/action_dispatch/middleware/callbacks.rb:27:in `block in call' activesupport (7.0.7) lib/active_support/callbacks.rb:99:in `run_callbacks' actionpack (7.0.7) lib/action_dispatch/middleware/callbacks.rb:26:in `call' actionpack (7.0.7) lib/action_dispatch/middleware/executor.rb:14:in `call' actionpack (7.0.7) lib/action_dispatch/middleware/actionable_exceptions.rb:17:in `call' actionpack (7.0.7) lib/action_dispatch/middleware/debug_exceptions.rb:28:in `call' actionpack (7.0.7) lib/action_dispatch/middleware/show_exceptions.rb:29:in `call' logster (2.13.0) lib/logster/middleware/reporter.rb:40:in `call' railties (7.0.7) lib/rails/rack/logger.rb:40:in `call_app' railties (7.0.7) lib/rails/rack/logger.rb:27:in `call' actionpack (7.0.7) lib/action_dispatch/middleware/remote_ip.rb:93:in `call' actionpack (7.0.7) lib/action_dispatch/middleware/request_id.rb:26:in `call' rack (2.2.8) lib/rack/method_override.rb:24:in `call' actionpack (7.0.7) lib/action_dispatch/middleware/executor.rb:14:in `call' actionpack (7.0.7) lib/action_dispatch/middleware/static.rb:23:in `call' rack (2.2.8) lib/rack/sendfile.rb:110:in `call' actionpack (7.0.7) lib/action_dispatch/middleware/host_authorization.rb:137:in `call' rack-mini-profiler (3.1.1) lib/mini_profiler.rb:413:in `call' message_bus (4.3.8) lib/message_bus/rack/middleware.rb:60:in `call' railties (7.0.7) lib/rails/engine.rb:530:in `call' railties (7.0.7) lib/rails/railtie.rb:226:in `public_send' railties (7.0.7) lib/rails/railtie.rb:226:in `method_missing' rack (2.2.8) lib/rack/urlmap.rb:74:in `block in call' rack (2.2.8) lib/rack/urlmap.rb:58:in `each' rack (2.2.8) lib/rack/urlmap.rb:58:in `call' unicorn (6.1.0) lib/unicorn/http_server.rb:634:in `process_client' unicorn (6.1.0) lib/unicorn/http_server.rb:739:in `worker_loop' unicorn (6.1.0) lib/unicorn/http_server.rb:547:in `spawn_missing_workers' unicorn (6.1.0) lib/unicorn/http_server.rb:143:in `start' unicorn (6.1.0) bin/unicorn:128:in ` ' bin/unicorn:96:in `load' bin/unicorn:96:in `block in ' bin/unicorn:95:in `fork' bin/unicorn:95:in ` ' // Full Trace omniauth (1.9.2) lib/omniauth/failure_endpoint.rb:25:in `raise_out!' omniauth (1.9.2) lib/omniauth/failure_endpoint.rb:20:in `call' omniauth (1.9.2) lib/omniauth/failure_endpoint.rb:12:in `call' omniauth (1.9.2) lib/omniauth/strategy.rb:491:in `fail!' /home/hardway/Downloads/omniauth-oauth2/lib/omniauth/strategies/oauth2.rb:88:in `callback_phase' plugins/discourse-openid-connect/lib/omniauth_open_id_connect.rb:142:in `callback_phase' omniauth (1.9.2) lib/omniauth/strategy.rb:238:in `callback_call' omniauth (1.9.2) lib/omniauth/strategy.rb:189:in `call!' omniauth (1.9.2) lib/omniauth/strategy.rb:169:in `call' omniauth (1.9.2) lib/omniauth/strategy.rb:192:in `call!' omniauth (1.9.2) lib/omniauth/strategy.rb:169:in `call' omniauth (1.9.2) lib/omniauth/strategy.rb:192:in `call!' omniauth (1.9.2) lib/omniauth/strategy.rb:169:in `call' omniauth (1.9.2) lib/omniauth/strategy.rb:192:in `call!' omniauth (1.9.2) lib/omniauth/strategy.rb:169:in `call' omniauth (1.9.2) lib/omniauth/strategy.rb:192:in `call!' omniauth (1.9.2) lib/omniauth/strategy.rb:169:in `call' omniauth (1.9.2) lib/omniauth/strategy.rb:192:in `call!' omniauth (1.9.2) lib/omniauth/strategy.rb:169:in `call' omniauth (1.9.2) lib/omniauth/builder.rb:45:in `call' lib/middleware/omniauth_bypass_middleware.rb:53:in `call' rack (2.2.8) lib/rack/tempfile_reaper.rb:15:in `call' rack (2.2.8) lib/rack/conditional_get.rb:27:in `call' rack (2.2.8) lib/rack/head.rb:12:in `call' actionpack (7.0.7) lib/action_dispatch/http/permissions_policy.rb:38:in `call' lib/content_security_policy/middleware.rb:12:in `call' lib/middleware/gtm_script_nonce_injector.rb:10:in `call' rack (2.2.8) lib/rack/session/abstract/id.rb:266:in `context' rack (2.2.8) lib/rack/session/abstract/id.rb:260:in `call' actionpack (7.0.7) lib/action_dispatch/middleware/cookies.rb:704:in `call' activerecord (7.0.7) lib/active_record/migration.rb:603:in `call' actionpack (7.0.7) lib/action_dispatch/middleware/callbacks.rb:27:in `block in call' activesupport (7.0.7) lib/active_support/callbacks.rb:99:in `run_callbacks' actionpack (7.0.7) lib/action_dispatch/middleware/callbacks.rb:26:in `call' actionpack (7.0.7) lib/action_dispatch/middleware/executor.rb:14:in `call' actionpack (7.0.7) lib/action_dispatch/middleware/actionable_exceptions.rb:17:in `call' actionpack (7.0.7) lib/action_dispatch/middleware/debug_exceptions.rb:28:in `call' actionpack (7.0.7) lib/action_dispatch/middleware/show_exceptions.rb:29:in `call' logster (2.13.0) lib/logster/middleware/reporter.rb:40:in `call' railties (7.0.7) lib/rails/rack/logger.rb:40:in `call_app' railties (7.0.7) lib/rails/rack/logger.rb:27:in `call' config/initializers/100-quiet_logger.rb:20:in `call' config/initializers/100-silence_logger.rb:29:in `call' actionpack (7.0.7) lib/action_dispatch/middleware/remote_ip.rb:93:in `call' actionpack (7.0.7) lib/action_dispatch/middleware/request_id.rb:26:in `call' rack (2.2.8) lib/rack/method_override.rb:24:in `call' actionpack (7.0.7) lib/action_dispatch/middleware/executor.rb:14:in `call' actionpack (7.0.7) lib/action_dispatch/middleware/static.rb:23:in `call' rack (2.2.8) lib/rack/sendfile.rb:110:in `call' actionpack (7.0.7) lib/action_dispatch/middleware/host_authorization.rb:137:in `call' lib/middleware/missing_avatars.rb:22:in `call' lib/middleware/turbo_dev.rb:31:in `call' rack-mini-profiler (3.1.1) lib/mini_profiler.rb:413:in `call' message_bus (4.3.8) lib/message_bus/rack/middleware.rb:60:in `call' railties (7.0.7) lib/rails/engine.rb:530:in `call' railties (7.0.7) lib/rails/railtie.rb:226:in `public_send' railties (7.0.7) lib/rails/railtie.rb:226:in `method_missing' rack (2.2.8) lib/rack/urlmap.rb:74:in `block in call' rack (2.2.8) lib/rack/urlmap.rb:58:in `each' rack (2.2.8) lib/rack/urlmap.rb:58:in `call' unicorn (6.1.0) lib/unicorn/http_server.rb:634:in `process_client' unicorn (6.1.0) lib/unicorn/http_server.rb:739:in `worker_loop' unicorn (6.1.0) lib/unicorn/http_server.rb:547:in `spawn_missing_workers' unicorn (6.1.0) lib/unicorn/http_server.rb:143:in `start' unicorn (6.1.0) bin/unicorn:128:in ` ' bin/unicorn:96:in `load' bin/unicorn:96:in `block in ' bin/unicorn:95:in `fork' bin/unicorn:95:in ` ' Possible reason Discourse OpenID Connect (OIDC) - #257 google_oauth2 Authentication failure! csrf_detected: OmniAuth::Strategies::OAuth2::CallbackError, csrf_detected | CSRF detected · Issue #58 · omniauth/omniauth-oauth2 · GitHub … The guidance or tips I want to get How authentication in discourse works? How discourse uses session? Discourse messaging mechanism It would be best if you could tell me the solution directly

I’m not recommending it, but for local development I took the somewhat brutal approach of editing the plugin’s callback_url method: discourse-openid-connect/lib/omniauth_open_id_connect.rb at main · discourse/discourse-openid-connect · GitHub. def callback_url full_host = 'http://localhost:4200' full_host + script_name + callback_path end That way it always returns http://localhost:4200/auth/oidc/callback Without that change, I couldn’t find a way to get the host part of the URL set to anything other than http://127.0.0.1:3000

[תמונה] wayway way: OIDC connection configuration on keycloak Valid redirect URIs: http://127.0.0.1:3000/auth/oidc/callback Possibly unrelated, but does setting the valid redirect URIs to http://127.0.0.1:4200/auth/oidc/callback make a difference? Also, there’s currently something strange going on with the Ubuntu/Debian dev environment where the site can be accessed at either localhost:4200 or 127.0.0.1:4200. Each of those domains creates a separate session. Probably not related to your issue, but maybe something that could cause issues for local development. I always use the localhost:4200 domain. That seems to be what’s expected.

[תמונה] simon: does setting the valid redirect URIs to http://127.0.0.1:4200/auth/oidc/callback make a difference? Yeah this would be my first thought as well. It’s important the authentication flow starts and ends on the same port, otherwise the session may be different. If you boot Rails and Ember-CLI together via bin/ember-cli -u, then things should be automatically configured for you. But if you’re starting them separately, make sure you set the DISCOURSE_PORT=4200 environment on the Rails server so that everything lines up correctly.

I tried, but “Invalid parameter: redirect_uri” appears in Keycloak. Boot Rails and Ember-CLI together via bin/ember-cli -u [image] Set the valid redirect URIs to http://127.0.0.1:4200/auth/oidc/callback. [image] [image] [image]

It appears that the cause is a discrepancy between the valid redirect URIs in Keycloak and the URIs depicted in the following illustration. [תמונה] wayway way: [image] image1920×901 145 KB The URI depicted within the image is http://127.0.0.1:8080/realms/mediawiki-realm/protocol/openid-connect/auth?client_id=mydiscourse&nonce=dce3dd8bccb09b25f88d1645d26b9d20b58e3d2ff3804f83ed79098c793a5ae2&redirect_uri=http%3A%2F%2F127.0.0.1%3A3000%2Fauth%2Foidc%2Fcallback&response_type=code&scope=openid+profile+email&state=7fd712dd2b28c8264eac170721b898b26ae8fb2edb9a2e9f Upon decoding the ‘redirect_uri’, its equivalence to http://127.0.0.1:3000/auth/oidc/callback What, indeed, ought to be the correct redirect_uri?

Would you be so kind as to divulge the platform utilized for identity verification during the creation of this plugin?

[תמונה] simon: Probably not related to your issue, but maybe something that could cause issues for local development. I always use the localhost:4200 domain. That seems to be what’s expected Thanks, it works. :blush: My workaround was to open discourse using 127.0.0.1:4200 instead of localhost:4200

בעיית CSRF בפיתוח עם תוסף 'Discourse OpenID Connect'

מפתח

wayway_way (wayway way) 20 באוקטובר,‏ 2023,‏ 3:57am 4

I tried, but “Invalid parameter: redirect_uri” appears in Keycloak.

Boot Rails and Ember-CLI together via bin/ember-cli -u

Set the valid redirect URIs to http://127.0.0.1:4200/auth/oidc/callback.

נושא		תגובות	צפיות
OpenID Connect extension not creating new Discourse users Product Support	19	4992	12 בינואר,‏ 2019
Redirecting from Keycloak to discourse with OIDC SSO	1	1047	16 בדצמבר,‏ 2021
Error using discourse-oauth2-basic plugin with NeonCRM SSO oauth2	28	5391	12 בפברואר,‏ 2020
Discourse OpenID Connect (OIDC) Plugin official , openid-connect , auth-plugins , included-in-core	46	52676	27 במאי,‏ 2026
Discourse ID fails to activate on my instance SSO unsupported-install , discourse-id	26	1095	22 באוקטובר,‏ 2025

בעיית CSRF בפיתוח עם תוסף 'Discourse OpenID Connect'

נושאים קשורים