# Getting signed data from the server

**URL:** https://meta.discourse.org/t/getting-signed-data-from-the-server/95084
**Category:** Development
**Created:** [August 19, 2018, 6:23am UTC](https://meta.discourse.org/t/getting-signed-data-from-the-server/95084 "2018-08-19T06:23:17Z")
**Posts on this page:** 1
**Showing post:** 19

<div class="post-metadata">

### Author: ![EGreg](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/egreg/32/133614_2.png) [@EGreg](https://meta.discourse.org/u/EGreg)
#### Post date: [August 23, 2018, 7:07pm UTC](https://meta.discourse.org/t/getting-signed-data-from-the-server/95084/19 "2018-08-23T19:07:38Z")

</div>

To be clear, I want to _use Discourse_ to do the authentication. I still need to understand, in _that case_:

1. Which URL do I redirect to, on `http://discourse_site/...`

2. How do I specify where to redirect back, as well as a nonce (“state” parameter in oAuth)

3. “Discourse will always send the user back here” lists `http://discourse_site` but I am talking about redirecting back to `https://somesite.com/success?sso=PAYLOAD&sig=SIG`

It seems to me, after reading the above, that the SSO plugin is NOT designed for this. It’s designed the other way - using my site for authentication. For example, as soon as you turn on `enable_sso` then:

> [@Setup DiscourseConnect - Official Single-Sign-On for Discourse (sso)](https://meta.discourse.org/t/setup-discourseconnect-official-single-sign-on-for-discourse-sso/13045/1):
>
> Users will no longer be able to use Discourse auth (username/password, google, etc)

So, fine. It seems that this is only designed to go one way. Then my question becomes: how can I migrate our existing users? I guess I can create accounts with the exact same email addresses in our app, but then how do we automatically link their account and data to these new accounts? _Does Discourse automatically match the SSO to existing accounts by email address? If so that will solve everything for our use case._

---

_[View the full topic](https://meta.discourse.org/t/getting-signed-data-from-the-server/95084)._