How to get SSO working with a Wordpress site? I’m a noob

support wordpress
1

I’ll attempt to explain my needs and see if what I’m trying to do is possible.

I use DigitalOcean for both my Wordpress site and my new discourse forum. The Wordpress is it’s own droplet with nginx and php7 installed running a somewhat standard LEMP stack build. This is the main domain.

I started up a second droplet using the one-click-install for Discourse forum available on DigitalOcean.

My goal is to have the Single Sign On working where Wordpress is the main site. This way my customers (who are purchasing subscription boxes) can automatically login and access the Discourse forum with the same login creds they designated on Wordpress.

As of right now I have followed the guides located within these forums and haven’t been successful in making SSO work.

My main question to start is, if the two sites are on different droplets with different server config and different ip addresses, will the SSO feature work?

2

Yes. The easiest setup is to have the Discourse droplet use a subdomain while the WP site uses the main domain.

2 Likes
3

Thanks so just for final clarification,

The two sites don’t need to be in a single docker in order to work?

4

My second question is about security.

What, if any, are the potential security risks of SSO with Wordpress? How does SSO share the login data and what type of security risk is it?

5

I believe @simon can speak to that.

6

On the wp-discourse Connection tab are you getting the ‘You are connected to Discourse!’ message?

If so, and you can’t get SSO working, are you using the DigitalOcean 1 click WordPress install? The last time I checked, it doesn’t install the php-curl extension. php-curl is required for SSO to work when HTTPS is enabled.

You can’t go wrong by installing it. This is a good guide: How To Install WordPress with LEMP on Ubuntu 16.04 | DigitalOcean

There is no Discourse login data saved on WordPress. The first time a user logs into Discourse from WordPress, Discourse checks if there is an existing user with the email address that is sent from Discourse. If there is, a SingleSignOnRecord is created for that user. The SingleSignOnRecord stores the user’s WordPress ID. On subsequent logins, the WordPress user’s ID is used to find the Discourse user. If a user without an account on Discourse logs in from WordPress, a new user and SingleSignOnRecord is created.

The biggest security risk in using SSO is if email addresses on the WordPress site are not being verified. The wp-discourse plugin checks whether or not an email address is verified. If it isn’t, it tells Discourse to send an activation email before the user is able to login to Discourse.

3 Likes
7

Thanks for the info! Very helpful.

Last question is more of an opinion question. I read the usecase suggestions for SSO and potential reasons why not to use it.

My plan for the forum is to allow our customers a place to gather and share their creations. We send out supplies for them to build things and then send extra parts for them to extend the build and create something unique. We figured a forum would be a great place for them to communicate and share their unique designs

We also figure that this knowledge and creativity could benefit anyone online interested. So we also wanted to make it public.

The initial reason for the SSO was to give the customers the easiest and most streamlined online experience by only having to create one account. This seems like it might pose a problem for the non subscribers since they will have to create a Wordpress account on our site to then access the forum.

In your opinion considering our goals, would you recommend a SSO to benefit the customers or a separate login to utilize the robust login features available in Discourse but also requiring two logins for the customers?

8

If most of the activity that requires logging in is going to happen on Discourse, I think you would be better of using the wp-discourse SSO Client option. That will allow users of your forum to easily create an account on WordPress when they want to buy something. You can embed a WordPress login link on your forum to make it really easy.

My guess is that using the SSO Provider option could decrease activity on a forum if users don’t have a good reason to be creating accounts on WordPress. (I don’t have any data to back this up though.)

2 Likes
9

Thanks,
To clarify slightly, our funnel right now is Wordpress landing page with email collection form —> send a newsletter saying “buy a subscription box” —> sales page —> checkout which requires a user account registration (username and password) w/ single optin —> then sit back and wait for your box to arrive —> then an email with Links to the build instructions and tutorials page.

All build instructions and media was originally going to be a blog post on Wordpress.

So the forum is almost the final step of the process where people can freely converse about the builds and ask for help. But I imagine the meat and potatoes of the process/interaction is over on Wordpress.

Does this help you in give a suggested login choice? :slight_smile:

I should also mention we are only 1 month old so we have no data on how our customers utilize the website.