Official Single-Sign-On for Discourse (sso) has an HMAC-256 encoding “Real world example” I cannot duplicate. [imagem] Setup DiscourseConnect - Official Single-Sign-On for Discourse (sso) SSO secret: d836444a9e4084d5b224a60c208dce14 Payload is Base64 encoded: bm9uY2U9Y2I2ODI1MWVlZmI1MjExZTU4…

The problem seems to be in the example, not the code, presumably a cut/paste error. Current Version: Raw payload is generated: nonce=cb68251eefb5211e58c00ff1395f0c0b Payload is Base64 encoded: bm9uY2U9Y2I2ODI1MWVlZmI1MjExZTU4YzAwZmYxMzk1ZjBjMGI=\n Payload is URL encoded: bm9uY2U9Y2I2ODI1MW…

The code was changed to use strict_encode64 (which doesn’t add the newlines) here: single_sign_on: encode the payload with strict_encode64 which doesn't add extraneous newlines committed 05:41PM - 17 Oct 17 UTC (UTC) …

Exemplo de HMAC-256 na página oficial do SSO

Suporte SSO

sam (Sam Saffron) Julho 18, 2018, 4:19am 2

Read through:

https://github.com/discourse/discourse/blob/master/lib/single_sign_on.rb#L80-L83

This code is carefully tested.

Hashing Secret + Payload for SSO

Tópico		Respostas	Visualizações
DiscourseConnect payload hash encoding mismatch SSO	4	1313	1 de Junho de 2021
Hashing Secret + Payload for SSO SSO	9	2643	6 de Novembro de 2020
Watch out for double url encoding of SSO payload SSO	0	1551	28 de Julho de 2019
SSO and e-mail addresses having a plus sign Support	4	2080	21 de Abril de 2021
Login error while trying to use Discourse as an identity provider (SSO, DiscourseConnect) SSO	3	897	30 de Maio de 2023

Exemplo de HMAC-256 na página oficial do SSO

Tópicos relacionados