# Microsoft Teams的Discourse集成？
**URL:** https://meta.discourse.org/t/discourse-integration-for-microsoft-teams/101577
**Category:** Feature
**Created:** [2018年十一月8日 00:13 UTC](https://meta.discourse.org/t/discourse-integration-for-microsoft-teams/101577 "2018-11-08T00:13:19Z")
**Posts on this page:** 18
**Page:** 1
### Author:  [@tophee](https://meta.discourse.org/u/tophee)
#### Post date: [2018年十一月8日 00:13 UTC](https://meta.discourse.org/t/discourse-integration-for-microsoft-teams/101577/1 "2018-11-08T00:13:19Z")
Apparently, Microsoft Teams is the fastest growing product in Microsoft’s history and in comparison to some of the other collaboration suites and enterprise social networks I kinda see why. However, when it comes to discussions, it is still miles away from discourse and chances are it will never catch up. Also, teams in Teams are currently limited to 2500 members and although that limit will be increases to 5000, it still means that it is not suitable for organization-wide discussions in larger organizations (discussions in Teams are only possible within teams, not across teams. So for everyone in the organization to be able to see a discussion, everyone has to be a member of a single team).
Discourse could fill these gaps but in order to properly integrate with Teams it would have to run in a [Teams tab](http://docs.microsoft.com/en-us/microsoftteams/platform/concepts/tabs/tabs-overview), which, I suppose, is an iframe.
I understand that discourse currently refuses to run in an iframe for security reasons but I wonder if certain iframes (like those in Teams) could be an exception?
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [2018年十一月8日 00:59 UTC](https://meta.discourse.org/t/discourse-integration-for-microsoft-teams/101577/2 "2018-11-08T00:59:39Z")
No idea until paying customers start asking us for it. None have yet.
---
### Author:  [@tophee](https://meta.discourse.org/u/tophee)
#### Post date: [2018年十一月8日 05:46 UTC](https://meta.discourse.org/t/discourse-integration-for-microsoft-teams/101577/3 "2018-11-08T05:46:30Z")
So you are saying it can be done but it is non-trivial?
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [2018年十一月8日 19:58 UTC](https://meta.discourse.org/t/discourse-integration-for-microsoft-teams/101577/4 "2018-11-08T19:58:01Z")
I think you totally buried the lede here 😉
Removing iframe busting code is technically possible but not a trivial thing to do
---
### Author:  [@tophee](https://meta.discourse.org/u/tophee)
#### Post date: [2018年十一月8日 21:16 UTC](https://meta.discourse.org/t/discourse-integration-for-microsoft-teams/101577/5 "2018-11-08T21:16:51Z")
> [@sam](#):
>
> I think you totally buried the lede here 😉
I’m standing on the hose. 🥴
> [@sam](#):
>
> Removing iframe busting code
I didn’t assume that what would need to be done is to remove the “iframe busting code” entirely but to disable it selectively in certain contexts.
---
### Author:  [@nathank](https://meta.discourse.org/u/nathank)
#### Post date: [2018年十一月23日 18:01 UTC](https://meta.discourse.org/t/discourse-integration-for-microsoft-teams/101577/6 "2018-11-23T18:01:20Z")
We would absolutely love it. A whole swath of employers in my field have just signed up to Teams, and it looks to be big.
Having an integration between Discourse and Teams would mean that we can get our new Discourse forum working brilliantly. At the moment it is Discourse vs Teams as we are just setting things up. We have compelling international collaboration reasons for using Discourse, but I fear without an integration it will fail to fly.
Please do it!
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [2018年十一月23日 18:16 UTC](https://meta.discourse.org/t/discourse-integration-for-microsoft-teams/101577/7 "2018-11-23T18:16:13Z")
What does “please do it” mean? What integration could there be other than SSO which already works, assuming you log in to existing internal systems using oauth 2 or ldap?
---
### Author:  [@nathank](https://meta.discourse.org/u/nathank)
#### Post date: [2018年十一月23日 18:19 UTC](https://meta.discourse.org/t/discourse-integration-for-microsoft-teams/101577/8 "2018-11-23T18:19:30Z")
Forgive me as I am quite ignorant of both Discourse and Teams. But learning fast.
I meant doing the work to enable the running Discourse from a tab as in the first post of this thread:
> [@tophee](#):
>
> Discourse could fill these gaps but in order to properly integrate with Teams it would have to run in a [Teams tab](http://docs.microsoft.com/en-us/microsoftteams/platform/concepts/tabs/tabs-overview), which, I suppose, is an iframe.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [2018年十一月26日 00:02 UTC](https://meta.discourse.org/t/discourse-integration-for-microsoft-teams/101577/9 "2018-11-26T00:02:18Z")
Just to clarify what is happening here, we ship a header with Discourse called:
```plaintext
X-Frame-Options: SAMEORIGIN
```
This stops sites adding yours site as an `IFRAME` which is a filthy SEO trick some people do to steal page rank and causes overall levels of confusion and do nasty things like clickjacking:
> **[Clickjacking](https://en.wikipedia.org/wiki/Clickjacking)**
>
> Clickjacking (classified as a user interface redress attack or UI redressing) is a malicious technique of tricking a user into clicking on something different from what the user perceives, thus potentially revealing confidential information or allowing others to take control of their computer while clicking on seemingly innocuous objects, including web pages.
> Clickjacking is an instance of the confused deputy problem, wherein a computer is tricked into misusing its authority.
> In 2002, it had ...
What I strongly support adding to Discourse is some ability to customize this header:
> **[X-Frame-Options header - HTTP | MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Frame-Options)**
>
> The HTTP X-Frame-Options response header can be used to indicate whether a browser should be allowed to render the document in a ,
In particular we could allow you to define:
```plaintext
X-Frame-Options: allow-from https://my-team-site.team.microsoft.com
```
This particular request does not come up too often, but I do support amending it. It is a bit of a tricky change cause we do need some defense in depth here, some of our assets are delivered not via the app and we can not swap in the magic value there.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [2018年十一月26日 00:56 UTC](https://meta.discourse.org/t/discourse-integration-for-microsoft-teams/101577/11 "2018-11-26T00:56:36Z")
Sure we could have a site setting that simply removes `X-Frame-Options` to start with. Default off of course, but once you turn it on, you opt in to giving up all framing protection.
---
### Author:  [@tobiaseigen](https://meta.discourse.org/u/tobiaseigen)
#### Post date: [2018年十一月26日 01:44 UTC](https://meta.discourse.org/t/discourse-integration-for-microsoft-teams/101577/15 "2018-11-26T01:44:18Z")
> [@codinghorror](#):
>
> have a site setting that simply removes `X-Frame-Options`
This seems quite the nuclear option. If it is possible, I would prefer Sam’s suggestion of allowing some URLs while still excluding the rest.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [2018年十一月26日 01:48 UTC](https://meta.discourse.org/t/discourse-integration-for-microsoft-teams/101577/16 "2018-11-26T01:48:40Z")
> [@tobiaseigen](#):
>
> some URLs
some URLs is not going to happen for a while, it requires CSP changes and we are not going to get into this right now:
>
That said we will allow `*` for everything, `domain.com` for a single domain or blank by default.
---
### Author:  [@nathank](https://meta.discourse.org/u/nathank)
#### Post date: [2018年十一月26日 06:30 UTC](https://meta.discourse.org/t/discourse-integration-for-microsoft-teams/101577/17 "2018-11-26T06:30:34Z")
For us,
> [@sam](#):
>
> That said we will allow `*` for everything, `domain.com` for a single domain or blank by default.
will be fine - thank you for listening! We are unlikely to be victims of clickbaiting as our networks are all private.
When do you think that this will be live?
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [2018年十一月26日 06:56 UTC](https://meta.discourse.org/t/discourse-integration-for-microsoft-teams/101577/18 "2018-11-26T06:56:41Z")
> [@nathank](#):
>
> as our networks are all private
This is why it’s not a big security concern to whitelist all domains @tobiaseigen , which is what I figured would be the case.
---
### Author:  [@ssvenn](https://meta.discourse.org/u/ssvenn)
#### Post date: [2018年十一月26日 07:21 UTC](https://meta.discourse.org/t/discourse-integration-for-microsoft-teams/101577/19 "2018-11-26T07:21:43Z")
This sounds very promising!
I suspect my company is going to end up in Teams too once the pressure to migrate away from Skype for Business beats the security concerns of moving users to a cloud service.
I have a goal of augmenting our traditional Outlook/Exchange e-mail with Discourse and finding a better chat tool than SfB for the daily high speed bot-assisted operations chat, voice and screen sharing (stuff that is outside the scope of Discourse).
If it becomes easy to link Discourse and Teams together that could make it a really nice combination. We already have excellent SSO plugins for Azure and traditional AD to make the user experience pretty seamless 🙂
---
### Author:  [@BrotherCreamy](https://meta.discourse.org/u/BrotherCreamy)
#### Post date: [2019年十二月2日 01:34 UTC](https://meta.discourse.org/t/discourse-integration-for-microsoft-teams/101577/20 "2019-12-02T01:34:57Z")
嗨 @codinghorror @sam，
只是想知道过去一年里有人继续推进这个问题吗？
修改/移除 `X-Frame-Options` 的选项已经实现了吗？
有人成功用 SSO 干净利落地完成这个操作吗？
谢谢大家！
---
### Author:  [@vinothkannans](https://meta.discourse.org/u/vinothkannans)
#### Post date: [2019年十二月5日 21:49 UTC](https://meta.discourse.org/t/discourse-integration-for-microsoft-teams/101577/24 "2019-12-05T21:49:55Z")
> [@BrotherCreamy](#):
>
> 修改/移除 `X-Frame-Options` 的选项是否已实现？
已完成。现在，您可以通过启用 `allow_embedding_site_in_an_iframe` 站点设置来移除它。
>
---
### Author:  [@BrotherCreamy](https://meta.discourse.org/u/BrotherCreamy)
#### Post date: [2019年十二月6日 04:39 UTC](https://meta.discourse.org/t/discourse-integration-for-microsoft-teams/101577/25 "2019-12-06T04:39:53Z")
谢谢 Vinoth！非常感谢。