# External SSO External ID not recognised
**URL:** https://meta.discourse.org/t/external-sso-external-id-not-recognised/80989
**Category:** SSO
**Created:** [February 20, 2018, 2:02am UTC](https://meta.discourse.org/t/external-sso-external-id-not-recognised/80989 "2018-02-20T02:02:03Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@aseemc](https://meta.discourse.org/u/aseemc)
#### Post date: [February 20, 2018, 2:02am UTC](https://meta.discourse.org/t/external-sso-external-id-not-recognised/80989/1 "2018-02-20T02:02:03Z")
If following two users with correct `nonce` are passed to Discourse site, they are always logged onto a single account.
```plaintext
Verbose SSO log: User was logged on forum-u3
nonce: 60a17e6704b8b7a8e1603822ab99f2d6
name: Darryn Goble
username: Forum-u1
email: darryn@example.com
avatar_url:
avatar_force_update:
require_activation:
bio:
external_id: qatest_1947
return_sso_url:
admin:
moderator:
suppress_welcome_message:
title:
add_groups:
remove_groups:
groups:
```
```plaintext
Verbose SSO log: User was logged on forum-u3
nonce: 0c9f10fbc15ccb99aeef41eb95dbdeae
name: Darryn Goble
username: Darryn
email: darryn@example.com
avatar_url:
avatar_force_update:
require_activation:
bio:
external_id: qatest_54
return_sso_url:
admin:
moderator:
suppress_welcome_message:
title:
add_groups:
remove_groups:
groups:
```
We have the following setup for SSO:
**How do we get Discourse to create separate users since they have separate `external_id` in our system ?**
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [February 20, 2018, 2:18am UTC](https://meta.discourse.org/t/external-sso-external-id-not-recognised/80989/2 "2018-02-20T02:18:48Z")
Well we key on `email` as well, so if you send us the same `email` address we automatically take over the account.
Sounds to me like you have untrusted emails in your sso origin. Is that the case?
---
### Author:  [@aseemc](https://meta.discourse.org/u/aseemc)
#### Post date: [February 20, 2018, 2:31am UTC](https://meta.discourse.org/t/external-sso-external-id-not-recognised/80989/3 "2018-02-20T02:31:54Z")
Yeah, we don’t really validate user emails.
I think in that case we might be better off not sending emails & rely only on the `external_id` , would that work?
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [February 20, 2018, 2:33am UTC](https://meta.discourse.org/t/external-sso-external-id-not-recognised/80989/4 "2018-02-20T02:33:20Z")
Oh, this is a big problem, sso is not what you want to use without emails. Instead you would use oauth2 or saml so the user can complete the auth flow and provide/validate an email when registering.
---
### Author:  [@aseemc](https://meta.discourse.org/u/aseemc)
#### Post date: [February 20, 2018, 2:36am UTC](https://meta.discourse.org/t/external-sso-external-id-not-recognised/80989/5 "2018-02-20T02:36:38Z")
Yeah, I get what you mean.
I think for now we will keep it as it is & have them converge to the same user.
Thanks for confirming it. 👍
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [February 20, 2018, 2:37am UTC](https://meta.discourse.org/t/external-sso-external-id-not-recognised/80989/6 "2018-02-20T02:37:34Z")
I would be very careful handing out in unvalidated emails, people can hijack admin accounts that way, it is hugely risky.
---
### Author:  [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [February 20, 2018, 2:42am UTC](https://meta.discourse.org/t/external-sso-external-id-not-recognised/80989/7 "2018-02-20T02:42:17Z")
@aseemc please take note of the warning below the ‘Enable SSO’ checkbox:
> (WARNING: USERS’ EMAIL ADDRESSES _MUST_ BE VALIDATED BY THE EXTERNAL SITE!)