새 사용자가 카테고리 링크를 클릭하면 「이 포럼은 초대만으로 접근 가능합니다」라는 메시지가 표시되고 OAuth2 로그인도 되지 않음

지원 SSO
,
1

Hi Everyone,

We have a private category in our Discourse instance that is restricted to a specific user group. We created a link so new users can access this category after logging in through OAuth2.

However, when new users who do not yet have a Discourse account click the link, they see this message:

“Sorry, access to this forum is by invite only.”

Because of this, they cannot proceed to the OAuth2 login flow and never reach the category. Existing users can access it normally.

We want new users to be able to sign in via OAuth2 and then be added to the appropriate group so they can see the category—but currently Discourse blocks them before login.

What we need help with

  • Why is the site showing “invite only” even though we want to allow OAuth2 login for new users?

  • Is there a setting like oauth2 allow uninvited users or invite only that we need to adjust?

  • What is the correct setup if we want:

    • the site not to be invite-only,

    • OAuth2 users to sign in as new accounts, and

    • group permissions to restrict category access after login?

Any guidance on properly configuring OAuth2 + group-based category restrictions would be appreciated.

image
image1167×376 23.1 KB

2

Hi — could you please check the Discourse site setting invite only and disable it if it’s enabled?

Disabling invite only will allow new users to sign in or register using OAuth2.
Once they’re signed in, you can use your group-membership rules (automation or manual assignment) to grant them access to the private category.

3

I disabled Invite Only and created a group invite link for a private category. When new users click the link, they log in through our OAuth2 SSO, but they are not automatically added to the group—so they still cannot see the category.

Need help understanding why group invite links do not add new SSO users to the group, and how to ensure new OAuth2 SSO users are automatically added when using the invite link.

4

Could you please check the discussion here:

and review the values in the “add groups”, “groups” and “remove groups” fields in your logs?

5

최근에 비슷한 문제를 경험했으며, OpenID Connect 플러그인 설정에서 “이메일로 OpenID Connect 매칭” 옵션을 비활성화하여 해결했습니다.

우리의 경우 주요 차이는 SSO로 자체 호스팅된 Authentik 인스턴스를 사용하고 있다는 점입니다. 또한, 새 사용자의 Authentik 계정이 설정되면 Discourse 계정을 생성하는 Authentik 웹훅이 있습니다. 이 웹훅에서는 먼저 Discourse 계정이 생성된 후, 해당 Authentik 계정이 접근할 수 있는 그룹에 따라 Discourse 그룹에 추가됩니다.

기본값과 다른, 현재 적용 중인 기타 관련 설정은 다음과 같습니다:

로그인 설정:

  • 로그인 필수
  • 초대 전용
  • 로컬 로그인 활성화 (비활성화됨)
  • 이메일을 통한 로컬 로그인 활성화 (비활성화됨)
  • 가입 CTA 활성화 (비활성화됨)
  • 인증 시 계정 생성 확인 스킵 (활성화됨)

OpenID Connect 플러그인 설정:

  • OpenID Connect 승인 범위 (email openid profile)
  • 이메일로 OpenID Connect 매칭 (비활성화됨)