# /admin/users/sync\_sso 403 Forbidden

**URL:** https://meta.discourse.org/t/admin-users-sync-sso-403-forbidden/111354
**Category:** SSO
**Created:** [March 12, 2019, 8:23am UTC](https://meta.discourse.org/t/admin-users-sync-sso-403-forbidden/111354 "2019-03-12T08:23:27Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![ulv8888](https://avatars.discourse-cdn.com/v4/letter/u/bcef8e/32.png) [@ulv8888](https://meta.discourse.org/u/ulv8888)
#### Post date: [March 12, 2019, 8:23am UTC](https://meta.discourse.org/t/admin-users-sync-sso-403-forbidden/111354/1 "2019-03-12T08:23:27Z")

</div>

Hi all

I need some assistance with POST to /admin/users/sync\_sso endpoint. The request (Postman) is:

```
POST /admin/users/sync_sso HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Cache-Control: no-cache

sso=cmVtb3ZlX2dyb3Vwcz1zdWJzY3JpYmVy&sig=3151a5a1808b3d27897373c725f676bfa83f6eeda593d4d9882f951dfd3ebd42&api_key=<api_key>&api_username=system

```

Discourse responds with 403 Forbidden and:

```
{
    "failed": "FAILED",
    "message": "Validation failed: Username can't be blank, Primary email can't be blank"
} 

```

“sso” and “sig” are generated by the client code (in php) using the algorithm from [Sync DiscourseConnect user data with the sync\_sso route](https://meta.discourse.org/t/sync-sso-user-data-with-the-sync-sso-route/84398)

I can’t figure out what’s wrong.

Thanks!

---

<div class="post-metadata">

### Author: ![simon](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/simon/32/339122_2.png) [@simon](https://meta.discourse.org/u/simon)
#### Post date: [March 12, 2019, 6:00pm UTC](https://meta.discourse.org/t/admin-users-sync-sso-403-forbidden/111354/2 "2019-03-12T18:00:35Z")

</div>

> [@ulv8888](#):
>
> “message”: “Validation failed: Username can’t be blank, Primary email can’t be blank”

Are you updating a user, or creating a new user? If you are updating a user who already exists on your system, you can omit the `username` and `email` from the SSO params. If the user doesn’t already exist on your Discourse site, omitting the `username` and `email` from the SSO params will cause the error you are getting. This is because Discourse is trying to create a new user from the params.