# External SSO activated, can't revert it :-(

**URL:** https://meta.discourse.org/t/external-sso-activated-cant-revert-it/112419
**Category:** Support
**Created:** [March 23, 2019, 7:01pm UTC](https://meta.discourse.org/t/external-sso-activated-cant-revert-it/112419 "2019-03-23T19:01:02Z")
**Posts on this page:** 11
**Page:** 1

<div class="post-metadata">

### Author: ![jhf2442](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jhf2442/32/131921_2.png) [@jhf2442](https://meta.discourse.org/u/jhf2442)
#### Post date: [March 23, 2019, 7:01pm UTC](https://meta.discourse.org/t/external-sso-activated-cant-revert-it/112419/1 "2019-03-23T19:01:02Z")

</div>

Hi,

I wanted to activate SSO to use discourse as an SSO provider for Mediawiki, but it looks like I’ve activated external SSO for discourse itself ☹

I’ve read oother threads describing workarounds, but they don’t work:

- SiteSettings.enable\_sso=false through ruby console → login form displays “unknown error” upon submission of user/password
- use backdoor /users/admin-login → blank screen with “[“BAD CSRF”]” after submiting the form
- selecting “resend password” in login form displays a 403 error in the dialog box upon submission

As I’ve logged out as admin (deleted all my cookies), I can’t access /logs to see if there’s some hint to be found there

So … anything I could do the regain access to my site ?

Many thanks

---

<div class="post-metadata">

### Author: ![Stephen](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/stephen/32/95011_2.png) [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [March 23, 2019, 8:44pm UTC](https://meta.discourse.org/t/external-sso-activated-cant-revert-it/112419/2 "2019-03-23T20:44:22Z")

</div>

You can disable SSO from the rails console or use the admin login path. Both are documented here on Meta if you use the search.

---

<div class="post-metadata">

### Author: ![jhf2442](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jhf2442/32/131921_2.png) [@jhf2442](https://meta.discourse.org/u/jhf2442)
#### Post date: [March 23, 2019, 8:51pm UTC](https://meta.discourse.org/t/external-sso-activated-cant-revert-it/112419/3 "2019-03-23T20:51:20Z")

</div>

that’s what I did, but it still doesn’t work !  
or is there another besides the ones I’ve listed in my original post ?

---

<div class="post-metadata">

### Author: ![jhf2442](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jhf2442/32/131921_2.png) [@jhf2442](https://meta.discourse.org/u/jhf2442)
#### Post date: [March 23, 2019, 8:52pm UTC](https://meta.discourse.org/t/external-sso-activated-cant-revert-it/112419/4 "2019-03-23T20:52:07Z")

</div>

Correction, because I saw a typo: SiteSetting.enable\_sso (no s in Setting !)

---

<div class="post-metadata">

### Author: ![jhf2442](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jhf2442/32/131921_2.png) [@jhf2442](https://meta.discourse.org/u/jhf2442)
#### Post date: [March 23, 2019, 8:53pm UTC](https://meta.discourse.org/t/external-sso-activated-cant-revert-it/112419/5 "2019-03-23T20:53:02Z")

</div>

and finally : SiteSetting.enable\_local\_logins = true also didn’t help

---

<div class="post-metadata">

### Author: ![Stephen](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/stephen/32/95011_2.png) [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [March 23, 2019, 9:08pm UTC](https://meta.discourse.org/t/external-sso-activated-cant-revert-it/112419/6 "2019-03-23T21:08:36Z")

</div>

Try `https://<yoursiteurl>/u/admin-login/`

---

<div class="post-metadata">

### Author: ![jhf2442](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jhf2442/32/131921_2.png) [@jhf2442](https://meta.discourse.org/u/jhf2442)
#### Post date: [March 23, 2019, 9:14pm UTC](https://meta.discourse.org/t/external-sso-activated-cant-revert-it/112419/7 "2019-03-23T21:14:37Z")

</div>

> [@jhf2442](#):
>
> use backdoor /users/admin-login -\> blank screen with “[“BAD CSRF”]” after submiting the form

/u seems to be an alias to /users ☹

---

<div class="post-metadata">

### Author: ![Stephen](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/stephen/32/95011_2.png) [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [March 23, 2019, 9:15pm UTC](https://meta.discourse.org/t/external-sso-activated-cant-revert-it/112419/8 "2019-03-23T21:15:02Z")

</div>

How was this instance installed? What version is it?

---

<div class="post-metadata">

### Author: ![jhf2442](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jhf2442/32/131921_2.png) [@jhf2442](https://meta.discourse.org/u/jhf2442)
#### Post date: [March 23, 2019, 9:19pm UTC](https://meta.discourse.org/t/external-sso-activated-cant-revert-it/112419/9 "2019-03-23T21:19:14Z")

</div>

docker container  
2 days ago it was reported to be up to date in the admin panel (as I have no access to it I can’t cehck the version)

---

<div class="post-metadata">

### Author: ![jhf2442](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jhf2442/32/131921_2.png) [@jhf2442](https://meta.discourse.org/u/jhf2442)
#### Post date: [March 25, 2019, 2:25pm UTC](https://meta.discourse.org/t/external-sso-activated-cant-revert-it/112419/10 "2019-03-25T14:25:09Z")

</div>

Problem worked around by restoring from a previous backup. Still no idea what went wrong ☹ but at least I have gained back access to my site

---

<div class="post-metadata">

### Author: ![system](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/system/32/443519_2.png) [@system](https://meta.discourse.org/u/system)
#### Post date: [April 24, 2019, 2:25pm UTC](https://meta.discourse.org/t/external-sso-activated-cant-revert-it/112419/11 "2019-04-24T14:25:30Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.
