# Auto Login enabled for public facing community?
**URL:** https://meta.discourse.org/t/auto-login-enabled-for-public-facing-community/223559
**Category:** Support
**Created:** [April 7, 2022, 1:53am UTC](https://meta.discourse.org/t/auto-login-enabled-for-public-facing-community/223559 "2022-04-07T01:53:47Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@BaneWilliams](https://meta.discourse.org/u/BaneWilliams)
#### Post date: [April 7, 2022, 1:53am UTC](https://meta.discourse.org/t/auto-login-enabled-for-public-facing-community/223559/1 "2022-04-07T01:53:47Z")
I’ve noticed a few posts on this, with most of them saying it is a feature only available for closed communities [Auto-sign-in with the OpenId Connect Plugin and AWS Cognito - support - Discourse Meta](https://meta.discourse.org/t/auto-sign-in-with-the-openid-connect-plugin-and-aws-cognito/145170)
[How to auto-login user in application web view - dev / sso - Discourse Meta](https://meta.discourse.org/t/how-to-auto-login-user-in-application-web-view/193879)
We are hoping to have a community where you only get an account as part of our product registration process, but we want to make the content of the forum visible so that way if people are trying to self help via google they can get an appropriate result while being unauthenticated. (also so we can potentially hit some SEO targets for our content)
Is this possible or is it a pipe dream? It seems like I’m not the first person to ask this question, or desire this product capability.
edit: In particular I’m talking about this specific aspect of OIDC specification - [Auto-sign-in with the OpenId Connect Plugin and AWS Cognito - #8 by david](https://meta.discourse.org/t/auto-sign-in-with-the-openid-connect-plugin-and-aws-cognito/145170/8)
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [April 7, 2022, 6:00am UTC](https://meta.discourse.org/t/auto-login-enabled-for-public-facing-community/223559/2 "2022-04-07T06:00:51Z")
So the issue is that some users will be logged in to your cognito and you don’t want them to get a login dialog if they try to reply? I thought that with [discourse connect](https://meta.discourse.org/t/13045?silent=true) that was the default behaviour.
You can make the site open to anonymous users and Google.
---
### Author:  [@BaneWilliams](https://meta.discourse.org/u/BaneWilliams)
#### Post date: [April 7, 2022, 6:17am UTC](https://meta.discourse.org/t/auto-login-enabled-for-public-facing-community/223559/3 "2022-04-07T06:17:50Z")
> [@pfaffman](#):
>
> So the issue is that some users will be logged in to your cognito and you don’t want them to get a login dialog if they try to reply?
In an ideal world a user viewing Discourse that has an account should be logged in at all times, this way we can capture all their viewing data. I will be making it so if a product user clicks a link in the product to view the community it will auth them, as well as any links that the user should only see if they are auth’d elsewhere (account page, for instance).
However if a user attempts self help via Google and ends up in the community, we can’t capture that data until they attempt to interact directly with the community, even if they’re auth’d elsewhere in our system. It seems the only way to solve for that is to have the login\_required site setting enabled, which if I understand effectively makes the site private.
> [@pfaffman](#):
>
> I thought that with [discourse connect](https://meta.discourse.org/t/13045) that was the default behaviour.
Thanks. I did not know this. I am a CM trying to understand all the ins and outs of three seperate products and it is melting my brain trying to get the particulars down for each one! Expect to see a few more posts from me trying to sort everything out, and I thank you for being patient.
---
### Author:  [@simonk](https://meta.discourse.org/u/simonk)
#### Post date: [April 7, 2022, 8:50am UTC](https://meta.discourse.org/t/auto-login-enabled-for-public-facing-community/223559/4 "2022-04-07T08:50:52Z")
> [@BaneWilliams](#):
>
> In an ideal world a user viewing Discourse that has an account should be logged in at all times, this way we can capture all their viewing data.
In the general case that is going to be impossible (how can you tell if an anonymous user has an account without prompting them to log in?). However, it should be possible to detect if a user already has an active session in your SSO site.
> [@Detecting user already logged in when using SSO](https://meta.discourse.org/t/detecting-user-already-logged-in-when-using-sso/26968/9):
>
> So, have Discourse have a \ script that goes like this: if (!Discourse.User.currentProp('username') { $.ajax(....., { .... dataType: "jsonp", success: function(xhr) { if (xhr.responseJSON.have\_account) { window.location = "/session/sso"; } } }); } It fails open - if the main site is down, the user can continue to browse as an anon on Discourse.
That topic is quite old, but I think the principle should still apply. Basically, add a URL with appropriate CORS support that returns a JSON response indicating whether the user has an active session. Then add some JS to your discourse theme that queries that URL and triggers the SSO process if an active session exists.
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [April 7, 2022, 9:15am UTC](https://meta.discourse.org/t/auto-login-enabled-for-public-facing-community/223559/5 "2022-04-07T09:15:10Z")
> [@BaneWilliams](#):
>
> Is this possible or is it a pipe dream? It seems like I’m not the first person to ask this question, or desire this product capability.
>
> edit: In particular I’m talking about this specific aspect of OIDC specification - [Auto-sign-in with the OpenId Connect Plugin and AWS Cognito - #8 by david](https://meta.discourse.org/t/auto-sign-in-with-the-openid-connect-plugin-and-aws-cognito/145170/8)
I’m afraid the general answer is still largely the same as last time
> [@Auto-sign-in with the OpenId Connect Plugin and AWS Cognito](https://meta.discourse.org/t/auto-sign-in-with-the-openid-connect-plugin-and-aws-cognito/145170/8):
>
> It is technically possible in the OIDC specification, but unfortunately Discourse does not currently support it.
The spec I was talking about is [OpenID Connect Session Management](https://openid.net/specs/openid-connect-session-1_0.html). Unfortunately, that iframe-based solution is becoming increasingly less useful because many browsers are now blocking third-party cookies by default. It now only works reliably if your identity provider and Discourse have the same ‘origin’.
As @simonk said, depending on your identity provider it might be possible to implement something custom via a theme component, but I’m not aware of any general solution we could add to Discourse itself.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [April 7, 2022, 11:36am UTC](https://meta.discourse.org/t/auto-login-enabled-for-public-facing-community/223559/6 "2022-04-07T11:36:08Z")
> [@david](#):
>
> As @simonk said, depending on your identity provider it might be possible to implement something custom via a theme component, but I’m not aware of any general solution we could add to Discourse itself.
But I guess I’m wrong.
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [April 7, 2022, 11:51am UTC](https://meta.discourse.org/t/auto-login-enabled-for-public-facing-community/223559/7 "2022-04-07T11:51:43Z")
You’re absolutely right that clicking ‘reply’ will trigger the login flow. And if [DiscourseConnect](https://meta.discourse.org/t/13045?silent=true) (or any other single login provider) is being used, then the Discourse login modal will be skipped 👍
However, I think the OP wants to have people automatically logged in, without them needing to click reply or ‘login’. With that kind of setup, it would be totally seamless for users to move between the main site and the community. We’ve achieved this for a couple of customers, but these have been bespoke implementations which can’t be easily generalised.
To give an example of one approach: if your forum is on `forum.example.com`, and your main site is on `example.com`, then the forum is allowed to read cookies from `example.com`. So a theme component can check for the existence of a cookie and do something like this:
```javascript
const cookie = require("discourse/lib/cookie").default;
if(cookie('name_of_example_com_auth_cookie') && !api.getCurrentUser()){
// User has an auth cookie for example.com. They are almost certainly
// logged in there, so let's run the auth flow
window.location = "https://forum.example.com/auth/oidc"
}
```
(various conditions apply here. e.g. the cookie must not be http\_only, must not be a host-only cookie, etc.)
---
### Author:  [@BaneWilliams](https://meta.discourse.org/u/BaneWilliams)
#### Post date: [April 7, 2022, 9:50pm UTC](https://meta.discourse.org/t/auto-login-enabled-for-public-facing-community/223559/8 "2022-04-07T21:50:19Z")
> [@david](#):
>
> However, I think the OP wants to have people automatically logged in, without them needing to click reply or ‘login’. With that kind of setup, it would be totally seamless for users to move between the main site and the community.
That is indeed the case. It’s good to know it’s possible, but custom.
Also since I did not know that a user hitting reply would skip the login dialog depending on implementation, that will alleviate a lot of my concerns in the first place. That is the major barrier to entry that I want to avoid, and I’m glad that it can be implemented.
Of course the data nerd in me wants the ideal version, and it’s possible we might aspire towards that. Knowing it’s possible for now is good enough. Thank you once again everyone for your time.
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [May 7, 2022, 9:50pm UTC](https://meta.discourse.org/t/auto-login-enabled-for-public-facing-community/223559/9 "2022-05-07T21:50:36Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.