I’ve enabled SSO on our company’s Discourse site, allowing external users from our app to log in. However, some staff members with company email addresses need access as moderators or administrators. Since these staff members aren’t registered in the app, we can’t create SSO accounts for them. Is there a built-in solution to handle their login separately, so they can authenticate using their company email, even with SSO enabled for external users?

@RGJ thanks for the quick reply. But AFAIK this works only for admins, right? I want to do login for staff and moderators i.e power users but non-admin

I’m afraid that won’t work for non-admins.

Can’t they log in as regular users with sso and then you give them admin rights?

That’s the only problem I have is that they can’t exist on SSO

If I understand what you’re saying, Then you can’t use sso. The first S is for single. You’ll need to use multiple OAuth2 logins, I think. Why can your admins not use your authentication system?

I don’t have a solution, but I seem to remember this exact issue having come up a few times in the past. It’s unfortunate that you can’t make the users moderators and give them access to the site via the /u/admin-login route. [image] Nishkarsh Tripathi: I’ve enabled SSO on our company’s Discourse site In case it’s relevant, what are you using for SSO? Is it DiscourseConnect, OAuth2, or OpenID Connect?

Hey @simon, I am using DiscourseConnect for SSO

We want our admins, staff, and moderators to use their company email for logging in. However, our current SSO mechanism relies on phone number OTP-based authentication, and the user must be registered on our app with their email ID, which isn’t feasible for these users. While we could implement custom handling to whitelist certain emails in our SSO, we’re exploring a more out-of-the-box solution. For instance, if it were possible for SSO to coexist with local login, we could disable local login for regular users while allowing admins and external users to log in with their email and password. Unfortunately, I don’t believe SSO and local login can coexist in this way.

[image] Nishkarsh Tripathi: I am using DiscourseConnect for SSO [image] Nishkarsh Tripathi: Unfortunately, I don’t believe SSO and local login can coexist in this way. That is correct. When DiscourseConnect is enabled, users can only login via the DiscourseConnect authentication provider site. I had the idea that the /u/admin-login route worked for all staff (admins and moderators), but looking at it now I see that it only allows for admins to bypass DiscourseConnect logins. Possibly a plugin could be developed that would allow members of a custom group to login with the admin-login method, but it would probably be better to find a way of getting external users onto your SSO authentication site.

Login for Staff and Moderators after enabling SSO

Product Support

RGJ (Richard - Communiteq) September 23, 2024, 5:45am 2

Go to https://forum.example.com/u/admin-login

Topic		Replies	Views
Seeking Guidance: Dual Authentication Setup for Moderators and Students SSO	4	682	December 13, 2023
How admin user re-logins after using discourse connect sso and custom domain SSO	1	1090	November 21, 2022
Moderator login with SSO enabled Product Support	5	763	April 27, 2020
Allow my application users to login to discourse Product Support	1	1216	January 17, 2022
Discourse SSO + normal login SSO	1	4430	August 1, 2017

Login for Staff and Moderators after enabling SSO

Related topics