Getting signed data from the server

[fefrei (Felix Freiberger)]

@EGreg

What is the endpoint that I should call from my site in order to get Discourse to return signed data?

Like this (but remember that the roles of your application and Discourse are swapped):

@sam

Discourse will redirect clients to sso_url with a signed payload: (say sso_url is https://somesite.com/sso )

You will receive incoming traffic with the following

https://somesite.com/sso?sso=PAYLOAD&sig=SIG

@EGreg

How do I pass the URL to redirect to, the “state” parameter from oAuth etc.?

You can’t, Discourse will always send the user back here:

@sam

Redirect back to http://discourse_site/session/sso_login?sso=payload&sig=sig

From there, you application can redirect the user wherever you want.

@EGreg

Does this plugin support oAuth 2 or anything like that, or do I implement a custom handler?

No, it’s a custom protocol.

@EGreg

Does it sanitize the redirect, do the latest additions to oAuth 2 like appsecret_proof etc?

Since Discourse redirects to a fixed URL to complete authentication, there’s no sanitization going on