# HMAC-256 example on Official SSO page

**URL:** https://meta.discourse.org/t/hmac-256-example-on-official-sso-page/92546
**Category:** SSO
**Created:** [July 17, 2018, 3:08pm UTC](https://meta.discourse.org/t/hmac-256-example-on-official-sso-page/92546 "2018-07-17T15:08:00Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![jehrlich](https://avatars.discourse-cdn.com/v4/letter/j/f05b48/32.png) [@jehrlich](https://meta.discourse.org/u/jehrlich)
#### Post date: [July 17, 2018, 3:08pm UTC](https://meta.discourse.org/t/hmac-256-example-on-official-sso-page/92546/1 "2018-07-17T15:08:01Z")

</div>

[Official Single-Sign-On for Discourse (sso)](https://meta.discourse.org/t/official-single-sign-on-for-discourse-sso/13045) has an HMAC-256 encoding “Real world example” I cannot duplicate.

> [@Setup DiscourseConnect - Official Single-Sign-On for Discourse (sso)](https://meta.discourse.org/t/setup-discourseconnect-official-single-sign-on-for-discourse-sso/13045/1):
>
> SSO secret: `d836444a9e4084d5b224a60c208dce14`
> 
> - Payload is Base64 encoded: `bm9uY2U9Y2I2ODI1MWVlZmI1MjExZTU4YzAwZmYxMzk1ZjBjMGI=\n`
> - HMAC-SHA256 is generated on the Base64 encoded Payload: `2828aa29899722b35a2f191d34ef9b3ce695e0e6eeec47deb46d588d70c7cb56`

There is an extra “'\n” appended to the Base64 encoded string, it should be

> bm9uY2U9Y2I2ODI1MWVlZmI1MjExZTU4YzAwZmYxMzk1ZjBjMGI=

Using [https://codebeautify.org/hmac-generator](https://codebeautify.org/hmac-generator) with HMAC-256 Algorithm on

`bm9uY2U9Y2I2ODI1MWVlZmI1MjExZTU4YzAwZmYxMzk1ZjBjMGI=`

I get

`1ce1494f94484b6f6a092be9b15ccc1cdafb1f8460a3838fbb0e0883c4390471`

Am I missing something?

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [July 18, 2018, 4:19am UTC](https://meta.discourse.org/t/hmac-256-example-on-official-sso-page/92546/2 "2018-07-18T04:19:30Z")

</div>

Read through:

[https://github.com/discourse/discourse/blob/master/lib/single\_sign\_on.rb#L80-L83](https://github.com/discourse/discourse/blob/master/lib/single_sign_on.rb#L80-L83)

This code is carefully tested.

---

<div class="post-metadata">

### Author: ![jehrlich](https://avatars.discourse-cdn.com/v4/letter/j/f05b48/32.png) [@jehrlich](https://meta.discourse.org/u/jehrlich)
#### Post date: [July 18, 2018, 9:25pm UTC](https://meta.discourse.org/t/hmac-256-example-on-official-sso-page/92546/3 "2018-07-18T21:25:02Z")

</div>

The problem seems to be in the example, not the code, presumably a cut/paste error.  
**Current Version:**

- Raw payload is generated: `nonce=cb68251eefb5211e58c00ff1395f0c0b`

- Payload is Base64 encoded: `bm9uY2U9Y2I2ODI1MWVlZmI1MjExZTU4YzAwZmYxMzk1ZjBjMGI=\n`

- Payload is URL encoded: `bm9uY2U9Y2I2ODI1MWVlZmI1MjExZTU4YzAwZmYxMzk1ZjBjMGI%3D%0A`

- HMAC-SHA256 is generated on the Base64 encoded Payload: `2828aa29899722b35a2f191d34ef9b3ce695e0e6eeec47deb46d588d70c7cb56`

I believe this should be as below. Note removal of last char on bas64 and URL encoded strings. Two online HMAC-SHA256 testers agree on the generated HMAC-SHA256 of 1ce1494f94484b6f6a092be9b15ccc1cdafb1f8460a3838fbb0e0883c4390471 on input data of bm9uY2U9Y2I2ODI1MWVlZmI1MjExZTU4YzAwZmYxMzk1ZjBjMGI= with key d836444a9e4084d5b224a60c208dce14

**Suggested revision**

- Raw payload is generated: `nonce=cb68251eefb5211e58c00ff1395f0c0b`

- Payload is Base64 encoded: `bm9uY2U9Y2I2ODI1MWVlZmI1MjExZTU4YzAwZmYxMzk1ZjBjMGI=`

- Payload is URL encoded: `bm9uY2U9Y2I2ODI1MWVlZmI1MjExZTU4YzAwZmYxMzk1ZjBjMGI%3D`

- HMAC-SHA256 is generated on the Base64 encoded Payload: `1ce1494f94484b6f6a092be9b15ccc1cdafb1f8460a3838fbb0e0883c4390471`

---

<div class="post-metadata">

### Author: ![supermathie](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/supermathie/32/507518_2.png) [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [September 11, 2018, 8:47pm UTC](https://meta.discourse.org/t/hmac-256-example-on-official-sso-page/92546/4 "2018-09-11T20:47:45Z")

</div>

The code was changed to use `strict_encode64` (which doesn’t add the newlines) here:  
[https://github.com/discourse/discourse/commit/518e101ad6a61146ed2b19c88da9c0c21472bd79](https://github.com/discourse/discourse/commit/518e101ad6a61146ed2b19c88da9c0c21472bd79)