Users and support staff are experiencing confusion with SSO (Single Sign-On) when impersonation is used on the origin platform. RyanK explains that when support staff impersonate users in their core platform, those users may inadvertently get logged into Discourse as someone else — triggering unwanted account creation and confusing emails. sam suggests a technical fix: having the SSO endpoint reject authentication requests when a user is impersonated, which RyanK agrees to explore with developers. Later, Ridz1208 reports similar issues — users logging in as other people (e.g., Jane Doe becoming Jane Smith) — and suspects impersonation by admins may be the cause. codinghorror follows up to ask if the issue was resolved via SSO endpoint changes, to which RyanK replies that it likely fell off the radar, and most staff have simply adapted to workarounds like using separate browsers. The core issue remains unresolved, causing ongoing confusion for users and inefficiency for staff.
It’s not uncommon for our support staff to impersonate a user within our core platform interface, which often results in them being logged in to the browser as a different user when they click over to the forum. This triggers creation of a discourse linked account and an email to someone who has never visited. While I like spreading the word to new people, this is very confusing to users and tedious for staff.
Is there any way around this other than using two different browsers at the same time and being careful?
I am using an SSO to get users to log in to a discourse instance from another web page. I am getting complaints from users saying that they are being logged in as someone else with the privileges of that other person !
I couldn’t put my hand on why before I read this. the typical complaint is usually from a Jane doe saying that when she logs in she is logged in as “Jane smith” instead… I’m not sure if the problem is from my SSO code or could it be that someone (there are other admins) impersonated Jane Doe which logged her out and then when she attemps a login she goes in as Jane Smith.