Can't make user admin, reverts when logging in

Product Support

סיכום מבוסס בינה מלאכותית

A user, Denis_Heraud, reports that granting admin rights to a user via the Discourse admin panel fails because the rights are revoked upon login, due to SSO (Single Sign-On). david confirms the use of SSO, and Falco identifies the issue: the SSO payload is sending admin: false, which overrides the admin status. Falco suggests adding admin: true to the SSO payload for the user. Denis_Heraud confirms the logs show admin: false and asks how to modify the payload per user, to which Falco explains that the payload is already user-specific. Falco also suggests removing admin and moderator from the payload and managing roles solely in Discourse. zogstrip checks in, and Denis_Heraud replies that he hasn’t resolved it yet but plans to address it after a database migration.

1

Hello everyone!

I’m trying to make a user an admin, I have tried going to admin/users/ and clicking on the Grant Admin and Grant Moderator buttons. If I go back to my user list, I can see that the user was granted those rights. However, as soon as the user logs in, the access is automatically revoked and reverts back to a regular user. I have also tried logging in via SSH and granting admin access to the user manually, butI get the same result where the user logs in and is reverted back to regular user rights…

What is going on here?

2

Are you using SSO? Or just the standard Discourse login system?

3

We are using SSO, yes.

4

Enable verbose SSO logs in settings. I believe that your SSO payload is sending admin: false and revoking the rights of the user.

5

Thanks Rafael, I’m checking the logs now. How would I fix this issue assuming that that is indeed what is happening?

6

Like Jeff said:

You will need to add admin: true for this user SSO payload.

7

Haha, yes I realize that, I’m just not sure how to go about it. :slight_smile: And you were right, the SSO log shows:

admin: false
moderator: false

So the question is, how would I pass on a parameter to a specific user’s SSO payload? I have never done that before.

9

You already do that!

If user A comes in, you respond with usera@mail.com for email and when user B comes you respond with userb@othermail.com. Your SSO payload is already diferent for each user.

Something that is probably easier, is dropping both moderator and admin from the payload altogether and manage this only trough Discourse. I believe that it will work, too.

11

Did you figure it out @Denis_Heraud?

12

@zogstrip Not yet but we may be migrating our database soon so I was waiting for that to happen before I take a stab at it.