What security risks may be involved with others knowing the sso secret? My WordPress install is multisite and multiuser. There doesn’t seem to be a way to set Discourse settings at the network level from the WP plugin. This doesn’t seem to be a huge problem otherwise (though it would smooth workfl…

I was going to say “if you know that the secret is compromised, cycle it and move on”; but that doesn’t seem to apply here. Uh, I think the fix is to lock down who can see the plugin settings. Where would that be done? I’m not a WP expert.

Unfortunately, the point of the subdomain admins having access is that they need access to other site-specific plugins. That makes isolating a single plugin difficult, and really, that’s the purpose of the Super Admin level. The clean solution would be to move that setting to the Network level of th…

The immediate idea that popped into my mind is to have the WordPress plugin see who is currently viewing the plugin settings. If any user credentials don’t match the admin(s) of the attached Discourse forum, then the plugin settings are greyed out or the page won’t load and will throw a 403.

[image] jetatomic: What are the risks with the sso secret being available to the subsite admins? Basically, they will be able to forge SSO packets and therefore log into the forum as any user, including admins or a brand-new admin.

Thanks, @purldator . That’s an interesting workaround. I have no idea how to implement it, but I see what you’re getting at and it makes sense. @riking , That’s what I was afraid of. Thank you for explaining why the secret needs to stay a secret. It’s very helpful to know the risks. This is beyond t…

Elusive obvious in the short term: SSO isn’t necessary for the sub-sites if all auth is routed through the main network site endpoint. So… drum roll… leave the sso secret field blank in the sub-sites’ plugins settings. Problem solved. Well I’m off to try to invent more ultra-complex solutions to no…

Security implications of exposed SSO Secret in multi-user install?

Product Support WordPress

riking (Kane York) May 22, 2015, 4:47am 5

Basically, they will be able to forge SSO packets and therefore log into the forum as any user, including admins or a brand-new admin.

Topic		Replies	Views
Problems with WP Multisite SSO SSO discourseconnect	11	3869	June 30, 2015
WordPress as SSO Client in a Multisite Installation WordPress	10	1279	January 12, 2018
WP + Discourse Multisite Work Around? WordPress	6	1821	August 1, 2017
How to get SSO working with a Wordpress site? I’m a noob WordPress	8	998	November 18, 2017
Wordpress Multisite with Multiple Discourse Instances WordPress	8	2573	February 14, 2020

Security implications of exposed SSO Secret in multi-user install?

Related topics