tytel is trying to implement authorization from a desktop application to a Discourse forum running on a subdomain. The goal is to verify that the user has access to the forum before starting the desktop app.
tytel initially considered using OAuth2, but david clarified that Discourse is not an OAuth2 provider. As an alternative, david suggested using Discourse’s SSO protocol or the “User API Key” flow, which is used for authenticating users on Discourse’s Android/iOS apps. tytel found the “User API Key” solution suitable for the desktop application scenario and plans to implement it.
I recently setup SSO so users can login to my top domain site (mysite.com) using their discourse login running on a subdomain (forum.mysite.com). Now I’m running into trouble because I also want to login to discourse from a desktop application.
A little background: I’m running an invite-only software beta for this desktop app and I’d want to make sure the user has access to the forum before starting up the desktop app.
Ideally I would have a basic form in my desktop app and make a post request to the forum to verify the user. I was thinking if Discourse was an OAuth2 provider it would work? I don’t think it is and I can’t find a way to do what I want but maybe I’m missing something.
I realize this is a weird use case and I’m new to the whole users/SSO/OAuth/etc world so if I’m falling down the wrong rabbit whole I’d appreciate if someone would throw me a rope
Discourse can’t be an OAuth2 provider, no (although I’d love to see a plugin that implements that one day - it’s definitely achievable).
Right now you can use Discourse’s own SSO protocol to implement this. In fact, we do this routinely for our internal tools at discourse.org:
The other option you have, which might be a better fit for the ‘desktop application’ scenario, is to use the “User API Key” flow. That’s how we authenticate users on our Android/iOS apps:
