Configuring OneLogin's SAML for Discourse

(Arpit Jalan) #1

Here’s how to configure Discourse to allow login and registration with OneLogin’s SAML.

Configure OneLogin

Create OneLogin account

Go to OneLogin and create an account.

Create new app: SAML Test Connector (IdP w/attr)

From your dashboard create new app.

Search for SAML Test Connector (IdP w/attr)

Configure app

Let’s assume that the URL of our Discourse instance is http://discourse.example.com. Let’s configure it.

Switch to Configuration tab and fill out these details:

  • Audience: http://discourse.example.com
  • Recipient: http://discourse.example.com/auth/saml/callback
  • ACS (Consumer) URL Validator: ^http:\/\/discourse\.example\.com\/auth\/saml\/callback\/$
  • ACS (Consumer) URL: http://discourse.example.com/auth/saml/callback

Copy certificate info and SAML 2.0 Endpoint

Switch to SSO tab.

Click on View Details link under certificate and copy SHA fingerprint and X.509 Certificate. Note them down, it will be used when configuring Discourse app.

Copy and note SAML 2.0 Endpoint (HTTP) URL.

Configure Discourse

Install discourse-saml plugin

Follow this guide to install discourse-saml plugin.

Configure discourse-saml plugin

Edit app.yml

cd /var/discourse
vim containers/app.yml

and add these variables under env section:

DISCOURSE_SAML_TITLE: "Example SAML"
DISCOURSE_SAML_TARGET_URL: {SAML 2.0 Endpoint URL}
DISCOURSE_SAML_LOG_AUTH: "true"
DISCOURSE_SAML_CERT_FINGERPRINT: {SHA fingerprint}
DISCOURSE_SAML_CERT: {X.509 Certificate without line breaks}
  • replace {SAML 2.0 Endpoint URL} with SAML 2.0 Endpoint URL copied from OneLogin SSO tab
  • replace {SHA fingerprint} with SHA fingerprint copied from OneLogin SSO tab -> Certificate section
  • replace {X.509 Certificate without line breaks} with X.509 Certificate copied from OneLogin SSO tab -> Certificate section, note that there must be no line breaks and remove begin and end marker

Rebuild app

For changes to take effect rebuild app

cd /var/discourse
./launcher rebuild app

Voila! :tada:

You should be able to login now using OneLogin’s SAML.

5 Likes

(Ahmed Alamiry) #2

I followed all the steps, but when I authenticate with saml it gives me this message "Sorry, there was an error authorizing your account. Perhaps you did not approve authorization? "

0 Likes

#3

Is there a way to remove the

Create New Account

Button that still appears when using OneLogin?

0 Likes

(Michael Brown) #4

Is the goal to force all users to authenticate via SAML?

If so, disabling Local Logins will accomplish this.

3 Likes

(John Lou) #5

Why I got an error using this course ?

0 Likes

(John Lou) #6

changed: no nginx, just docker(http force to https)

0 Likes

(John Lou) #7

@techAPJ Could you help to give a solution for this problem?

you can contact me via this post or my email. Thanks very much!

I used https(force http to https, just docker,no nginx proxy)

the error was as below:

0 Likes

(Jeff Atwood) #8

We only directly support people who purchase a hosting package on our hosting platform. Did you wish to purchase a hosting plan? www.discourse.org/buy

3 Likes

(John Lou) #9

@codinghorror Only paid user can get solution?

I an a Discourse fans, and I want to use OneLogin(saml idp) to connect Discourse(saml sp) and Magento2(saml sp).

Thanks a lot.

0 Likes

(Vinoth Kannan) #10

No, it means we can’t afford one-to-one/direct support for non-customer users. Also read the :warning: note in plugin README file.

0 Likes

(John Lou) #11

@vinothkannans From the error , It showd me, I shouldn’t do anything for this, It has no error report for me.
So I can’t get the error reason now…

0 Likes

(Jay Pfaffman) #12

You don’t see any errors in the rails log?

SAML is often difficult to configure and different for each situation. If you cannot figure it out with the available documentation you might ask for help in the #marketplace.

The last one I worked on took me several hours.

3 Likes

(John Lou) #13

Yeah, I find no logs about this.
I am just a little different this course(https), so I want to check:If I used http forced to https, should I do something about the discourse-saml plugin from the github?

0 Likes