# Configure OneLogin's SAML for Discourse

**URL:** https://meta.discourse.org/t/configure-onelogins-saml-for-discourse/68295
**Category:** Integrations
**Tags:** sso, how-to
**Created:** [August 18, 2017, 7:56am UTC](https://meta.discourse.org/t/configure-onelogins-saml-for-discourse/68295 "2017-08-18T07:56:24Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![Discourse](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/discourse/32/148734_2.png) [@Discourse](https://meta.discourse.org/u/Discourse)
#### Post date: [August 18, 2017, 7:56am UTC](https://meta.discourse.org/t/configure-onelogins-saml-for-discourse/68295/1 "2017-08-18T07:56:24Z")

</div>

Here’s how to configure Discourse to allow login and registration with OneLogin’s SAML.

## Configure OneLogin

### Create OneLogin account

Go to [OneLogin](https://www.onelogin.com/) and create an account.

### Create new app: SAML Test Connector (IdP w/attr)

From your dashboard create new app.

 ![image](https://global.discourse-cdn.com/meta/original/3X/4/a/4ab3abc67faf694f2a67299b00b7f0436c9bcb0c.png)

Search for **SAML Test Connector (IdP w/attr)**

 ![image](https://global.discourse-cdn.com/meta/original/3X/2/7/273726d7c29c1604a2283ae49290e9f60e0acd82.png)

### Configure app

Let’s assume that the URL of our Discourse instance is `http://discourse.example.com`. Let’s configure it.

Switch to **Configuration** tab and fill out these details:

- **Audience** : `http://discourse.example.com`
- **Recipient** : `http://discourse.example.com/auth/saml/callback`
- **ACS (Consumer) URL Validator**: `^http:\/\/discourse\.example\.com\/auth\/saml\/callback\/$`
- **ACS (Consumer) URL**: `http://discourse.example.com/auth/saml/callback`

 ![image](https://global.discourse-cdn.com/meta/original/3X/2/1/21eac1b5285b3ebfb836d51bdd9df661b1317804.png)

### Copy certificate info and SAML 2.0 Endpoint

Switch to **SSO** tab.

Click on `View Details` link under certificate and copy `SHA fingerprint` and `X.509 Certificate`. Note them down, it will be used when configuring Discourse app.

 ![image](https://global.discourse-cdn.com/meta/original/3X/b/f/bf7f57f71345d12fd3fd8caa6522041691b00acf.png)

Copy and note `SAML 2.0 Endpoint (HTTP)` URL.

## Configure Discourse

### Install `discourse-saml` plugin

Follow [this guide](https://meta.discourse.org/t/install-plugins-on-a-self-hosted-site/19157) to install [`discourse-saml` plugin](https://github.com/discourse/discourse-saml).

### Configure `discourse-saml` plugin

The plugin can be configured in two ways:

#### Option 1: Site Settings (recommended)

After installing and rebuilding, go to your Discourse admin panel and navigate to **Admin → Plugins → SAML**. Enable the `saml_enabled` setting and configure the following:

- **saml\_target\_url** : the `SAML 2.0 Endpoint URL` copied from OneLogin SSO tab
- **saml\_cert\_fingerprint** : the `SHA fingerprint` copied from OneLogin SSO tab → Certificate section
- **saml\_cert** : the `X.509 Certificate` copied from OneLogin SSO tab → Certificate section
- **saml\_log\_auth** : enable for debugging

#### Option 2: Environment Variables

Alternatively, you can configure the plugin via environment variables in `app.yml`. Note that when environment variables are used, all SAML site settings are hidden from the admin UI.

Edit `app.yml`

```plaintext
cd /var/discourse
vim containers/app.yml

```

and add these variables under `env` section:

```
DISCOURSE_SAML_TITLE: "Example SAML"
DISCOURSE_SAML_TARGET_URL: {SAML 2.0 Endpoint URL}
DISCOURSE_SAML_LOG_AUTH: "true"
DISCOURSE_SAML_CERT_FINGERPRINT: {SHA fingerprint}
DISCOURSE_SAML_CERT: {X.509 Certificate without line breaks}

```

- replace {SAML 2.0 Endpoint URL} with `SAML 2.0 Endpoint URL` copied from OneLogin SSO tab
- replace {SHA fingerprint} with `SHA fingerprint` copied from OneLogin SSO tab → Certificate section
- replace {X.509 Certificate without line breaks} with `X.509 Certificate` copied from OneLogin SSO tab → Certificate section, note that there must be no line breaks and remove begin and end marker

### Rebuild app

For changes to take effect rebuild app

```plaintext
cd /var/discourse
./launcher rebuild app

```

### Voila! :tada:

You should be able to login now using OneLogin’s SAML.

 ![image](https://global.discourse-cdn.com/meta/original/3X/e/4/e40967800537a8a260d7733ad6312b8cea078275.png)

> Last edited by @JammyDodger 2024-05-26T07:29:26Z
> 
> > **Check document**
> >
> > Perform check on document: