Configuring OneLogin's SAML for Discourse


(Arpit Jalan) #1

Here’s how to configure Discourse to allow login and registration with OneLogin’s SAML.

Configure OneLogin

Create OneLogin account

Go to OneLogin and create an account.

Create new app: SAML Test Connector (IdP w/attr)

From your dashboard create new app.

Search for SAML Test Connector (IdP w/attr)

Configure app

Let’s assume that the URL of our Discourse instance is http://discourse.example.com. Let’s configure it.

Switch to Configuration tab and fill out these details:

  • Audience: http://discourse.example.com
  • Recipient: http://discourse.example.com/auth/saml/callback
  • ACS (Consumer) URL Validator: ^http:\/\/discourse\.example\.com\/auth\/saml\/callback\/$
  • ACS (Consumer) URL: http://discourse.example.com/auth/saml/callback

Copy certificate info and SAML 2.0 Endpoint

Switch to SSO tab.

Click on View Details link under certificate and copy SHA fingerprint and X.509 Certificate. Note them down, it will be used when configuring Discourse app.

Copy and note SAML 2.0 Endpoint (HTTP) URL.

Configure Discourse

Install discourse-saml plugin

Follow this guide to install discourse-saml plugin.

Configure discourse-saml plugin

Edit app.yml

cd /var/discourse
vim containers/app.yml

and add these variables under env section:

DISCOURSE_SAML_TITLE: "Example SAML"
DISCOURSE_SAML_TARGET_URL: {SAML 2.0 Endpoint URL}
DISCOURSE_SAML_LOG_AUTH: "true"
DISCOURSE_SAML_CERT_FINGERPRINT: {SHA fingerprint}
DISCOURSE_SAML_CERT: {X.509 Certificate without line breaks}
  • replace {SAML 2.0 Endpoint URL} with SAML 2.0 Endpoint URL copied from OneLogin SSO tab
  • replace {SHA fingerprint} with SHA fingerprint copied from OneLogin SSO tab -> Certificate section
  • replace {X.509 Certificate without line breaks} with X.509 Certificate copied from OneLogin SSO tab -> Certificate section, note that there must be no line breaks and remove begin and end marker

Rebuild app

For changes to take effect rebuild app

cd /var/discourse
./launcher rebuild app

Voila! :tada:

You should be able to login now using OneLogin’s SAML.


(Ahmed Alamiry) #2

I followed all the steps, but when I authenticate with saml it gives me this message "Sorry, there was an error authorizing your account. Perhaps you did not approve authorization? "


#3

Is there a way to remove the

Create New Account

Button that still appears when using OneLogin?


(Michael Brown) #4

Is the goal to force all users to authenticate via SAML?

If so, disabling Local Logins will accomplish this.