# 如何在 discourse\_docker 部署旁部署 SSO 桥接？
**URL:** https://meta.discourse.org/t/how-to-deploy-a-sso-bridge-alongside-a-discourse-docker-deployment/110003
**Category:** SSO
**Created:** [2019年二月25日 08:26 UTC](https://meta.discourse.org/t/how-to-deploy-a-sso-bridge-alongside-a-discourse-docker-deployment/110003 "2019-02-25T08:26:30Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@consideRatio](https://meta.discourse.org/u/consideRatio)
#### Post date: [2019年二月25日 08:26 UTC](https://meta.discourse.org/t/how-to-deploy-a-sso-bridge-alongside-a-discourse-docker-deployment/110003/1 "2019-02-25T08:26:30Z")
I realized I wanted to _develop_ and _deploy_ a [Discourse SSO](https://meta.discourse.org/t/13045?silent=true) endpoint that wraps authentication to a OIDC provider. The endpoint is now developed as a Flask application available as a PyPI package: [discourse-sso-oidc-bridge-consideratio](http://github.com/consideratio/discourse-sso-oidc-bridge). But, I now would like to deploy it, and preferably alongside my discourse\_docker deployment.
## Question 1 - Does it make sense to integrate the bridge deployment with my discourse deployment?
I have deployed discourse following [the INSTALL-cloud.md tutorial](https://github.com/discourse/discourse/blob/master/docs/INSTALL-cloud.md). While I could deploy this [Discourse SSO](https://meta.discourse.org/t/13045?silent=true) OIDC Bridge in a standalone manner somewhere, it would be great if it could integrate with my discourse deployment instead. But, I need to understand a lot about this deployment in order to conclude if it could make sense to deploy this bridge alongside. Also, I have a lot of learning on how to accomplish it. Perhaps I could get some help understanding various parts?
Starting out, does it make sense to attempt this?
## Question 2 - What requirements does a integrated bridge/discourse deployment put on the Bridge Flask application?
It would be great to realize soon if an integrated deployment requires certain things by the Flask application.
### About the Bridge Flask application
#### Endpoints declared
- `/` - A redirect to Discourse
- `/sso/login`
- `/sso/auth`
- `/logout`
## Reference stuff
- The [discourse-docker](https://github.com/discourse/discourse_docker) repo:
- Acts as a foundation of [the INSTALL-cloud.md tutorial](https://github.com/discourse/discourse/blob/master/docs/INSTALL-cloud.md).
- References [nginx.sample.conf](https://github.com/discourse/discourse/edit/master/config/nginx.sample.conf) from the [discourse/discourse](https://github.com/discourse/discourse) repo.
- Relies on .yaml files interpreted by code in the [discourse/pups](https://github.com/discourse/pups) repo.
- Composes a single Dockerfile and builds an image by using a set of templates
## Question 3 - So, I should add a pups .yaml template that I can consume?
It seems like I ought to make a template alongside those found in [discourse/discourse\_docker’s template folder](https://github.com/discourse/discourse_docker/tree/master/templates), does this make sense?
## Question 4 - How to augment the nginx configuration with additional locations?
I assume I also need to configure the nginx utilized by my Discourse to direct traffic to the sso-oidc bridge endpoints such as `/sso/login` `/sso/auth` and `/logout`. I have seen various of replace commands utilized from the .yaml pups templates in the nginx configuration, but I have not seen a template add a new location which may be more tricky.
Also, perhaps this location should be added very early on in the sequence of modifying the nginx config as other steps may refine the location? But, the key question is how to add the location entry in the nginx config at all.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [2019年二月25日 08:29 UTC](https://meta.discourse.org/t/how-to-deploy-a-sso-bridge-alongside-a-discourse-docker-deployment/110003/2 "2019-02-25T08:29:34Z")
If you are running a bridge I would strongly recommend you keep it as simple as possible and just run it in a cheap dedicated droplet in its own container.
If you want to run it with Discourse the sanest thing to do here is simply improve the official OIDC plugin to add the group feature vs go down this path.
---
### Author:  [@consideRatio](https://meta.discourse.org/u/consideRatio)
#### Post date: [2019年二月25日 08:34 UTC](https://meta.discourse.org/t/how-to-deploy-a-sso-bridge-alongside-a-discourse-docker-deployment/110003/3 "2019-02-25T08:34:39Z")
Thank you for the directions @sam! I’ll focus on making a Dockerfile that builds into an image exposing the bridge and is meant to run in a standalone manner.
---
### Author:  [@consideRatio](https://meta.discourse.org/u/consideRatio)
#### Post date: [2019年二月26日 18:45 UTC](https://meta.discourse.org/t/how-to-deploy-a-sso-bridge-alongside-a-discourse-docker-deployment/110003/4 "2019-02-26T18:45:31Z")
Wieeee I got got it to function as a bridge hosted standalone from discourse stuff: [GitHub - consideRatio/discourse-sso-oidc-bridge: Discourse SSO OIDC Bridge - A Python PyPI package · GitHub](https://github.com/consideratio/discourse-sso-oidc-bridge)
I deployed it on using Kubernetes and a Helm chart that I made.
---
### Author:  [@consideRatio](https://meta.discourse.org/u/consideRatio)
#### Post date: [2019年三月2日 22:21 UTC](https://meta.discourse.org/t/how-to-deploy-a-sso-bridge-alongside-a-discourse-docker-deployment/110003/5 "2019-03-02T22:21:21Z")
@sam do you see a reasonable way for this Python based Dockerized bridge to be integrated on the same VM that a discourse\_docker deployment resides?
It is my understanding that for the bridge to be a plugin it must be written in Ruby, and that the .yaml files in /templates of discourse\_docker are snippets to build one image rather than templates of other images to deploy alongside the primary discourse image.
Hmmm, perhaps there is someone who has demonstrated how one could run an additional docker container on the VM? I’m thinking that we could optionally startup the Dockerized bridge I made alongside the discourse container, and add some nginx rules using a .yaml file within /templates to access the additional docker container or something like that?
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [2019年三月3日 22:33 UTC](https://meta.discourse.org/t/how-to-deploy-a-sso-bridge-alongside-a-discourse-docker-deployment/110003/6 "2019-03-03T22:33:50Z")
I can think of many ways, but all of them are way more complex than just sending a PR to the OIDC plugin to add the missing features 😊
You can run HAProxy on the host and terminate SSL there, then have 1 container for your web and one for you bridge. With zero knowledge this would probably take you 4-12 hours to swing. My question is … is it worth the $60 a year savings at that point?
---
### Author:  [@consideRatio](https://meta.discourse.org/u/consideRatio)
#### Post date: [2019年三月5日 06:07 UTC](https://meta.discourse.org/t/how-to-deploy-a-sso-bridge-alongside-a-discourse-docker-deployment/110003/7 "2019-03-05T06:07:33Z")
Ah thanks for the input @sam!
One great aspect about open source projects to me is that what I do can benefit many more than me, and that is what motivated me to come up with smoother solution than spinning up a secondary VM or similar to host the bridge.
---
### Author:  [@tobiaseigen](https://meta.discourse.org/u/tobiaseigen)
#### Post date: [2026年四月26日 20:05 UTC](https://meta.discourse.org/t/how-to-deploy-a-sso-bridge-alongside-a-discourse-docker-deployment/110003/8 "2026-04-26T20:05:49Z")
你好，Erik！你还在吗？我正考虑使用 Discourse 作为两个其他应用（Nextcloud 和 Mailcow）的身份提供商，你创建的这个桥接工具看起来非常完美。不过，你的 GitHub 仓库已经五年没有更新了。所以我是否应该寻找其他替代方案？
> **[GitHub - consideRatio/discourse-sso-oidc-bridge: Discourse SSO OIDC Bridge - A Python PyPI package](https://github.com/consideRatio/discourse-sso-oidc-bridge)**
>
> Discourse SSO OIDC Bridge - A Python PyPI package