Discourse OpenID Connect (OIDC)

Customization Plugin
, , ,
317

:partying_face: This plugin is now bundled with Discourse core as part of Bundling more popular plugins with Discourse core. If you are self-hosting and use the plugin, you need to remove it from your app.yml before your next upgrade.

3 Likes
318

yes i did for a client.

320

We would love to be able to synchronise some groups on Discourse with OIDC groups we have. We found that there has been a PR providing this functionality, but it was not considered further:
https://github.com/discourse/discourse/pull/34763/changes

Would it be possible to include this into Discourse’s functionality?

2 Likes
321

Will users automatically be removed once they are no longer members of the respective group?

322

Yes they will :+1:

323

Hmm, this does not match my testing actually.

324

Hello all, I’m using the OpenID Connect plugin and trying to pass custom parameters in the /authorize request via openid connect authorize parameters, but it doesn’t seem to work reliably.

Is this officially supported? If not, what’s the recommended way to send custom context to the IdP ?

Thanks!
@david

325

Hi,

the plugin works well for years, but I stumbled upon my first SSO user having a username ending in an underscore, e.g. a disallowed username.

That user cannot login to Discourse. I think OIDC then tries to create an account with a username just without the underscore. Which is fine, but if that account already exists (username foo exists, username foo_ cannot login because “Account already exists” error), there seems to be an impersonation (attempt) in some part:

The username foo gets an email that they tried to create an account or tried to change the email of an account but that email was already taken.

This is during first-login, e.g. account-creation via SSO, for foo_. So foo_ tries to create an account as foobut cant because the name is already taken. But why does the original foo now get a email-notification for that?

You just tried to create an account at \<discourse\>, or tried to change the email of an account to \<email of foo\>

Is there a solution for the problem of having username and username_ in OIDC, like configuring the way discourse handles invalid usernames during auth?

326

Hello,

Thanks for last edits on this plugin, but how i can synchronize admins by oidc ?

Thanks