Discourse/Drupal SSO Username Questions

This is the result of a recent change. Previously, if a username was not supplied in the SSO payload, a username would be created based on the user’s email address. The risk in doing this is that it potentially exposes user’s email addresses. If no username is supplied in the SSO payload, Discourse now sets the username to “user” with a number appended so that usernames are unique.

The solution to this is to supply a username in the SSO payload. If you really want to create usernames based on user’s email addresses, you should split the email address at the @ character and send the name part of the address as the username.

I believe you are using DiscourseConnect for SSO. This allows you to set quite a few parameters in the SSO payload. Have a look at the ACCESSORS and BOOLS lists at the top of this file to see which parameters can be set through the DiscourseConnect payload: discourse/single_sign_on.rb at main · discourse/discourse · GitHub. You will see that both bio and title can be set in this way.

1 Like