Discourse Wordpress plugin SSO wishlist

support wordpress
1

Our aim is to use Wordpress as a repository for static content such as photo and file libraries, and photo essays. We have a load of old static content which we wish to host on the Wordpress site, and our “For Sale/Wanted” section is on the Wordpress site (using AWPCP). To that end, using Discourse as our SSO provider is just what we were looking for… however.

Logging:
The functionality just kind of happens. How difficult would it be to add a Discourse log similar to admin/logs/staff_action_logs which tracked Login and SSO events?
I’m thinking of something along the lines of a log with columns for
Username:
Action: Created WP account, Accessed WP account, Failed SSO request
When:
Details: Error message (in the case of a failed SSO access)

Error Messages:
When a user already has a preexisting account on WP, but the passwords aren’t identical if they try to use the SSO to login the error message is:

The email address supplied by Discourse does not match your account. Probably a user other than yourself is logged into Discourse on your device. Please try visiting the Discourse forum and logging that user out. You should then be able to sync your account with Discourse.

This was a user with identical email and username, but different passwords.

Access control:
Could the Plugin restrict account creation to only discourse users? Despite having the Akismet plugin on our WP we’re averaging something like 50 account creations per day.
At the moment the plugin is open to any discourse user. It would be nice if we could limit that, either by Trust Level, or by group membership.
With group membership throttling you could do something like only members of the group WP_Subscriber can use the SSO. Taking it to the next level you could map groups to roles in WP (i.e. WP_Subscriber>>Subscriber, WP_Contributor>Contributor)

1 Like
2

All somewhat reasonable requests, but not within the near-future scope of what we need wp-discourse to do. If you have the budget for it, you could work directly with @simon as a contractor on this.

1 Like
3

The issue isn’t that the passwords are different, they aren’t being checked. The error is being created by WordPress when it attempts to create a new user with an email that is already used. I think the problem is that the error message isn’t very clear. When there are existing accounts on both WordPress and Discourse, the user needs to log through WordPress to sync their accounts before they are able to use the Discourse login.

It would also be possible to add an option to the plugin to allow accounts to be synced through email addresses. This would make the process of syncing accounts between WordPress and Discourse a lot more straightforward. There is some risk in doing this, as email addresses can be edited on WordPress without the user having to confirm them.

It could be done, but I think it would have to be through a separate plugin. For now, errors are being logged. You can enable logging in your wp-config.php :

define( 'WP_DEBUG_LOG', true);
define('WP_DEBUG', true);
define('WP_DEBUG_DISPLAY', false);

Create a debug.log file in the wp-content directory to view the log.

Yes, I can see how that would be useful. It could be done, but it would be a bit of work to setup because the user information that would be required to do this isn’t returned by Discourse with the payload that’s being used to authenticate the user.

4

Here’s an approach that might help both with the problem of syncing existing users and with the problem of controlling access to which Discourse users can create accounts on WordPress.

  • add an option to the plugin to redirect from the default login path of yoursite.com/login to the Discourse SSO provider URL.

  • password protect yoursite.com/wp-login.php so that it is only accessible to site admins.

  • change the logout redirect on your site so that it doesn’t try to bring users to yoursite.com/wp-login.php.

  • add an option to the plugin to sync existing users by their email address

  • for logging into WordPress, embed the login link directly on Discourse: <a href="http://yoursite.com/?discourse_sso=1&redirect_to=http://yoursite.com/some-page">Login to WordPress</a>

You could have fairly good control over who would be able to create an account on WordPress by either only displaying the WordPress login link on pages that are accessible to a certain level of user, or by using some javascript to display different login links on Discourse depending on the trust level of the current user. For example, a user with a trust level less than 3 could have a the link bring them to a page that explained that you need to know them better before they can create an account on the WordPress site.

The changes to the wp-discourse plugin that would be required for this to work are easy to make.

3 Likes