Configure OneLogin's SAML for Discourse

documentation sysadmin
1

Here’s how to configure Discourse to allow login and registration with OneLogin’s SAML.

Configure OneLogin

Create OneLogin account

Go to OneLogin and create an account.

Create new app: SAML Test Connector (IdP w/attr)

From your dashboard create new app.

image
image1936×564 25.2 KB

Search for SAML Test Connector (IdP w/attr)

image
image1766×392 24.2 KB

Configure app

Let’s assume that the URL of our Discourse instance is http://discourse.example.com. Let’s configure it.

Switch to Configuration tab and fill out these details:

  • Audience: http://discourse.example.com
  • Recipient: http://discourse.example.com/auth/saml/callback
  • ACS (Consumer) URL Validator: ^http:\/\/discourse\.example\.com\/auth\/saml\/callback\/$
  • ACS (Consumer) URL: http://discourse.example.com/auth/saml/callback

image
image1964×1406 188 KB

Copy certificate info and SAML 2.0 Endpoint

Switch to SSO tab.

Click on View Details link under certificate and copy SHA fingerprint and X.509 Certificate. Note them down, it will be used when configuring Discourse app.

image
image1962×596 43.9 KB

Copy and note SAML 2.0 Endpoint (HTTP) URL.

Configure Discourse

Install discourse-saml plugin

Follow this guide to install discourse-saml plugin.

Configure discourse-saml plugin

Edit app.yml

cd /var/discourse
vim containers/app.yml

and add these variables under env section:

DISCOURSE_SAML_TITLE: "Example SAML"
DISCOURSE_SAML_TARGET_URL: {SAML 2.0 Endpoint URL}
DISCOURSE_SAML_LOG_AUTH: "true"
DISCOURSE_SAML_CERT_FINGERPRINT: {SHA fingerprint}
DISCOURSE_SAML_CERT: {X.509 Certificate without line breaks}
  • replace {SAML 2.0 Endpoint URL} with SAML 2.0 Endpoint URL copied from OneLogin SSO tab
  • replace {SHA fingerprint} with SHA fingerprint copied from OneLogin SSO tab → Certificate section
  • replace {X.509 Certificate without line breaks} with X.509 Certificate copied from OneLogin SSO tab → Certificate section, note that there must be no line breaks and remove begin and end marker

Rebuild app

For changes to take effect rebuild app

cd /var/discourse
./launcher rebuild app

Voila! :tada:

You should be able to login now using OneLogin’s SAML.

image
image1448×632 26.7 KB

5 Likes
2

I followed all the steps, but when I authenticate with saml it gives me this message "Sorry, there was an error authorizing your account. Perhaps you did not approve authorization? "

3

Is there a way to remove the

Create New Account

Button that still appears when using OneLogin?

4

Is the goal to force all users to authenticate via SAML?

If so, disabling Local Logins will accomplish this.

4 Likes
5

Why I got an error using this course ?

TIM%E5%9B%BE%E7%89%8720190401164748
TIM图片20190401164748.png1501×1062 71.1 KB

6

changed: no nginx, just docker(http force to https)

7

@techAPJ Could you help to give a solution for this problem?

you can contact me via this post or my email. Thanks very much!

I used https(force http to https, just docker,no nginx proxy)

the error was as below:

sso
sso.png1551×1280 87.7 KB

8

We only directly support people who purchase a hosting package on our hosting platform. Did you wish to purchase a hosting plan? www.discourse.org/buy

3 Likes
9

@codinghorror Only paid user can get solution?

I an a Discourse fans, and I want to use OneLogin(saml idp) to connect Discourse(saml sp) and Magento2(saml sp).

Thanks a lot.

10

No, it means we can’t afford one-to-one/direct support for non-customer users. Also read the :warning: note in plugin README file.

11

@vinothkannans From the error , It showd me, I shouldn’t do anything for this, It has no error report for me.
So I can’t get the error reason now…

12

You don’t see any errors in the rails log?

SAML is often difficult to configure and different for each situation. If you cannot figure it out with the available documentation you might ask for help in the #marketplace.

The last one I worked on took me several hours.

3 Likes
13

Yeah, I find no logs about this.
I am just a little different this course(https), so I want to check:If I used http forced to https, should I do something about the discourse-saml plugin from the github?

14

Did according to the instructions. Created a new user in OneLogin, gave him the right to use the created application.
When logging into Discourse, I see this page:

“Sorry, there was an error authorizing your account. Perhaps you did not approve authorization?”

What am I doing wrong?

1 Like
15

does the open source version support saml?

16

There is only one version of Discourse available, which is the open source version. What differs is hosting and some hosts choose to stay on our stable release, some stay on specific older versions and others (including us at Discourse.org) stay on the latest release test-passed.

This is explained a bit more here Hosting options (Discourse hosting vs. 3rd party hosting) - #9 by eviltrout.

1 Like