Official Single-Sign-On for Discourse (sso) has an HMAC-256 encoding “Real world example” I cannot duplicate. [immagine] Setup DiscourseConnect - Official Single-Sign-On for Discourse (sso) SSO secret: d836444a9e4084d5b224a60c208dce14 Payload is Base64 encoded: bm9uY2U9Y2I2ODI1MWVlZmI1MjExZT…

The problem seems to be in the example, not the code, presumably a cut/paste error. Current Version: Raw payload is generated: nonce=cb68251eefb5211e58c00ff1395f0c0b Payload is Base64 encoded: bm9uY2U9Y2I2ODI1MWVlZmI1MjExZTU4YzAwZmYxMzk1ZjBjMGI=\n Payload is URL encoded: bm9uY2U9Y2I2ODI1MW…

The code was changed to use strict_encode64 (which doesn’t add the newlines) here: single_sign_on: encode the payload with strict_encode64 which doesn't add extraneous newlines committed 05:41PM - 17 Oct 17 UTC (UTC) …

Esempio HMAC-256 sulla pagina ufficiale SSO

Supporto SSO

sam (Sam Saffron) 18 Luglio 2018, 4:19am 2

Read through:

https://github.com/discourse/discourse/blob/master/lib/single_sign_on.rb#L80-L83

This code is carefully tested.

Hashing Secret + Payload for SSO

Argomento		Risposte	Visualizzazioni
DiscourseConnect payload hash encoding mismatch SSO	4	1313	Giugno 1, 2021
Hashing Secret + Payload for SSO SSO	9	2643	Novembre 6, 2020
Watch out for double url encoding of SSO payload SSO	0	1551	Luglio 28, 2019
SSO and e-mail addresses having a plus sign Support	4	2080	Aprile 21, 2021
Login error while trying to use Discourse as an identity provider (SSO, DiscourseConnect) SSO	3	897	Maggio 30, 2023

Esempio HMAC-256 sulla pagina ufficiale SSO

Argomenti correlati