# Custom SSO not working after secure\_session added as a parameter
**URL:** https://meta.discourse.org/t/custom-sso-not-working-after-secure-session-added-as-a-parameter/182655
**Category:** SSO
**Created:** [March 9, 2021, 5:20pm UTC](https://meta.discourse.org/t/custom-sso-not-working-after-secure-session-added-as-a-parameter/182655 "2021-03-09T17:20:46Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@pmills](https://meta.discourse.org/u/pmills)
#### Post date: [March 9, 2021, 5:20pm UTC](https://meta.discourse.org/t/custom-sso-not-working-after-secure-session-added-as-a-parameter/182655/1 "2021-03-09T17:20:46Z")
Hello! We have written a custom SSO plugin to bundle our company’s login details into a package that Discourse can use for handling logins and creating accounts. With v2.7.0beta4, we started getting errors that we were not providing a new parameter, secure\_session. I can’t find any details anywhere about what the format of this parameter should be and what it should contain. Is there any additional documentation anywhere for this update?
Thanks!
---
### Author:  [@simon](https://meta.discourse.org/u/simon)
#### Post date: [March 9, 2021, 5:55pm UTC](https://meta.discourse.org/t/custom-sso-not-working-after-secure-session-added-as-a-parameter/182655/2 "2021-03-09T17:55:43Z")
> [@pmills](#):
>
> we started getting errors that we were not providing a new parameter, secure\_session. I can’t find any details anywhere about what the format of this parameter should be and what it should contain.
Do you know the exact error message you are seeing? My understanding is that Discourse now ties the SSO `nonce` parameter to the user’s session. That means that if an app has been generating the `nonce` by making a background request to `/session/sso` the `nonce` will not be valid. Possibly this is the issue that you are running into.
---
### Author:  [@pmills](https://meta.discourse.org/u/pmills)
#### Post date: [March 9, 2021, 7:06pm UTC](https://meta.discourse.org/t/custom-sso-not-working-after-secure-session-added-as-a-parameter/182655/3 "2021-03-09T19:06:06Z")
Certainly! Here’s the error stack we’re seeing in our APM:
```plaintext
ArgumentError: missing keyword: :secure_session
…r/www/discourse/app/models/discourse_single_sign_on.rb: 28:in `initialize'
/var/www/discourse/lib/single_sign_on.rb: 65:in `new'
/var/www/discourse/lib/single_sign_on.rb: 65:in `parse'
…ourse_account_auth/lib/service_gateway_current_user.rb: 72:in `upsert_sso_record'
…ourse_account_auth/lib/service_gateway_current_user.rb: 53:in `create_sso_record'
…ourse_account_auth/lib/service_gateway_current_user.rb: 28:in `current_user'
/var/www/discourse/lib/current_user.rb: 36:in `current_user'
```
The `service_gateway_current_user.rb` is part of our plugin to build the payload to send to `DiscourseSingleSignOn` based on the “Service Gateway” headers (“Service Gateway” being our company’s internal structure for determining if you’re logged into our system).
To explain that bit of the stack there:
- Our `current_user` function uses our headers to lookup a `SingleSignOnRecord` where the `external_id` matches the User ID in the headers. If that’s not the case, we go into the `create_sso_record` section.
- `create_sso_record` creates a hash – `{ external_id: sg_headers[:user_id], email: sg_headers[:email] }` – and sends that to our `upsert_sso_record` function.
- `upsert_sso_record` takes that hash (`payload` in the context below) and tries to create a `DiscourseSingleSignOn` object:
```plaintext
def upsert_sso_record(payload)
encoded_query = Base64.encode64(payload.to_query)
sig = OpenSSL::HMAC.hexdigest('sha256', ENV['SSO_SECRET'], encoded_query)
sso = DiscourseSingleSignOn.parse({ sso: encoded_query, sig: sig }.to_query)
if SiteSetting.verbose_sso_logging
Rails.logger.warn("Verbose SSO log: Started SSO process\n\n#{sso.diagnostics}")
Rails.logger.warn("SSO Payload:\n\n#{payload}")
end
begin
user = sso.lookup_or_create_user(@request.ip)
rescue ActiveRecord::RecordInvalid => ex
Rails.logger.error "Unable to find/create sso user #{ex}"
end
user
end
```
The `parse` call on the 3rd line of that function is where it seems to be getting into the issue. Once it tries to `initialize` the object, the `secure_session` value it’s expecting is not there.
---
### Author:  [@Hekate\_Nichols\_NR](https://meta.discourse.org/u/Hekate_Nichols_NR)
#### Post date: [March 11, 2021, 5:09pm UTC](https://meta.discourse.org/t/custom-sso-not-working-after-secure-session-added-as-a-parameter/182655/4 "2021-03-11T17:09:48Z")
Bump! I am also curious about this!
---
### Author:  [@simon](https://meta.discourse.org/u/simon)
#### Post date: [March 11, 2021, 6:57pm UTC](https://meta.discourse.org/t/custom-sso-not-working-after-secure-session-added-as-a-parameter/182655/5 "2021-03-11T18:57:42Z")
I’m wondering if setting the new `discourse_connect_csrf_protection` site setting to `false` will fix the issue for you. That site setting is hidden, so it needs to be set from the Rails console. You can find details about it in the replies to this topic: [DiscourseConnect flow no longer functions](https://meta.discourse.org/t/discourseconnect-flow-no-longer-functions/182844).
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [March 11, 2021, 7:17pm UTC](https://meta.discourse.org/t/custom-sso-not-working-after-secure-session-added-as-a-parameter/182655/6 "2021-03-11T19:17:45Z")
Unfortunately I don’t think that new setting will help by itself - the code internals will still require passing in a `secure_session` object, even though it’s not used.
In general we would recommend using [the official hooks](https://meta.discourse.org/t/adding-a-new-managed-authentication-method-to-discourse/106695) for authentication plugins, rather than overriding core’s [DiscourseConnect](https://meta.discourse.org/t/13045?silent=true) implementation.
> [@pmills](#):
>
> The `parse` call on the 3rd line of that function is where it seems to be getting into the issue. Once it tries to `initialize` the object, the `secure_session` value it’s expecting is not there.
It’s tricky to know for sure without seeing the whole plugin, but you could try passing in a `nil` value for `secure_session`. Doing that, alongside toggling the new site setting, _might_ help get things a little closer to working.
---
### Author:  [@pmills](https://meta.discourse.org/u/pmills)
#### Post date: [March 12, 2021, 12:01am UTC](https://meta.discourse.org/t/custom-sso-not-working-after-secure-session-added-as-a-parameter/182655/7 "2021-03-12T00:01:52Z")
After digging into the v2.7.0.beta4 code some more, I see that `ApplicationController` has a `secure_session` definition. Changing our plugin code to the following seems to work in our Staging environment:
```plaintext
sso = DiscourseSingleSignOn.parse({ sso: encoded_query, sig: sig }.to_query, secure_session: secure_session)
```
…Is it really that simple? 🤔
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [March 12, 2021, 12:42am UTC](https://meta.discourse.org/t/custom-sso-not-working-after-secure-session-added-as-a-parameter/182655/8 "2021-03-12T00:42:05Z")
That sounds like it should work - the secure session does normally come from that method in the ApplicationController. 🙂
---
### Author:  [@pmills](https://meta.discourse.org/u/pmills)
#### Post date: [March 12, 2021, 3:53pm UTC](https://meta.discourse.org/t/custom-sso-not-working-after-secure-session-added-as-a-parameter/182655/9 "2021-03-12T15:53:40Z")
Awesome! Thanks for letting me rubber-duck this issue. 🦆 🤘