External SSO External ID not recognised

Product Support SSO

AI-generated summary

The discussion revolves around the issue of External SSO External ID not being recognized in Discourse. aseemc shares that despite passing two users with correct nonce and different external_id, they are always logged into a single account. sam explains that Discourse keys on email as well, so when the same email address is sent, it automatically takes over the account.

sam suspects that the issue might be due to untrusted emails in the SSO origin, which aseemc confirms. aseemc suggests relying only on external_id instead of sending emails, but sam advises against using SSO without email validation, recommending OAuth2 or SAML instead.

After discussion, aseemc decides to keep the current setup, allowing users to converge to the same account. However, sam and supermathie emphasize the security risk of handing out unvalidated emails, citing the warning below the ‘Enable SSO’ checkbox.

1

If following two users with correct nonce are passed to Discourse site, they are always logged onto a single account.

Verbose SSO log: User was logged on forum-u3

nonce: 60a17e6704b8b7a8e1603822ab99f2d6
name: Darryn Goble
username: Forum-u1
email: darryn@example.com
avatar_url: 
avatar_force_update: 
require_activation: 
bio: 
external_id: qatest_1947
return_sso_url: 
admin: 
moderator: 
suppress_welcome_message: 
title: 
add_groups: 
remove_groups: 
groups: 

Verbose SSO log: User was logged on forum-u3

nonce: 0c9f10fbc15ccb99aeef41eb95dbdeae
name: Darryn Goble
username: Darryn
email: darryn@example.com
avatar_url: 
avatar_force_update: 
require_activation: 
bio: 
external_id: qatest_54
return_sso_url: 
admin: 
moderator: 
suppress_welcome_message: 
title: 
add_groups: 
remove_groups: 
groups:

We have the following setup for SSO:

image
image866×764 39.9 KB

How do we get Discourse to create separate users since they have separate external_id in our system ?

2

Well we key on email as well, so if you send us the same email address we automatically take over the account.

Sounds to me like you have untrusted emails in your sso origin. Is that the case?

3

Yeah, we don’t really validate user emails.

I think in that case we might be better off not sending emails & rely only on the external_id , would that work?

4

Oh, this is a big problem, sso is not what you want to use without emails. Instead you would use oauth2 or saml so the user can complete the auth flow and provide/validate an email when registering.

5

Yeah, I get what you mean.

I think for now we will keep it as it is & have them converge to the same user.

Thanks for confirming it. :+1:

6

I would be very careful handing out in unvalidated emails, people can hijack admin accounts that way, it is hugely risky.

7

@aseemc please take note of the warning below the ‘Enable SSO’ checkbox:

(WARNING: USERS’ EMAIL ADDRESSES MUST BE VALIDATED BY THE EXTERNAL SITE!)