# How to handle Discourse SSO when the authentication site allows users to change emails?
**URL:** https://meta.discourse.org/t/how-to-handle-discourse-sso-when-the-authentication-site-allows-users-to-change-emails/107374
**Category:** SSO
**Created:** [24 בינואר, 2019, 8:03am UTC](https://meta.discourse.org/t/how-to-handle-discourse-sso-when-the-authentication-site-allows-users-to-change-emails/107374 "2019-01-24T08:03:59Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@jp9](https://meta.discourse.org/u/jp9)
#### Post date: [24 בינואר, 2019, 8:03am UTC](https://meta.discourse.org/t/how-to-handle-discourse-sso-when-the-authentication-site-allows-users-to-change-emails/107374/1 "2019-01-24T08:03:59Z")
We use a [Discourse SSO](https://meta.discourse.org/t/13045?silent=true) flow that we have implemented based on this guide: [Setup DiscourseConnect - Official Single-Sign-On for Discourse (sso)](https://meta.discourse.org/t/official-single-sign-on-for-discourse-sso/13045)
It has worked well for us. But now we want to allow users in our system to change their e-mail and this seems to lead to problems.
When I change the email of my user in our system, SSO to Discourse stops working.
> Login Error
>
> There is a problem with your account. Please contact the site’s administrator.
I guess that Discourse receives a payload with an email and a username that don’t match and doesn’t know what to do.
**What is a good way to handle this?**
The best idea I have come up with is to use the Discourse API to change the users email in Discourse to match that in out system before initiating SSO.
But I don’t know if this is possible. Below is my failed attempt.
Here is my request:
```plaintext
https://forum-stage.{domain}.com/users/{username}/preferences/email
Headers:
Content-Type: application/x-www-form-urlencoded
Accept: application/json
Body (as x-www-form-urlencoded in Postman):
email: testemail@testdomain.com
api_key: 75a...77d
api_username: system
```
And here is the response I receive
```plaintext
{
"errors": [
"You are not permitted to view the requested resource."
],
"error_type": "invalid_access"
}
```
---
### Author:  [@simonv3](https://meta.discourse.org/u/simonv3)
#### Post date: [12 באוגוסט, 2019, 1:34am UTC](https://meta.discourse.org/t/how-to-handle-discourse-sso-when-the-authentication-site-allows-users-to-change-emails/107374/2 "2019-08-12T01:34:50Z")
I’m experiencing this too - did you ever figure out a way around this?
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [12 באוגוסט, 2019, 11:35pm UTC](https://meta.discourse.org/t/how-to-handle-discourse-sso-when-the-authentication-site-allows-users-to-change-emails/107374/3 "2019-08-12T23:35:15Z")
This should not be the case, we primarily key on the SSO id.
You can use the sync sso endpoint to sync the emails on Discourse side if you want to do so proactively but changing emails in your system should always work.
The one exception is
Discourse thinks SSO id is 5 email is [bob@jane.com](mailto:bob@jane.com)
You log in with SSO id of 6 email is [bob@jane.com](mailto:bob@jane.com)
This is not resolvable so you will need to manually intervene. (sync sso id 6 first)
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [24 בפברואר, 2023, 5:50am UTC](https://meta.discourse.org/t/how-to-handle-discourse-sso-when-the-authentication-site-allows-users-to-change-emails/107374/4 "2023-02-24T05:50:30Z")
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [24 בפברואר, 2023, 7:13am UTC](https://meta.discourse.org/t/how-to-handle-discourse-sso-when-the-authentication-site-allows-users-to-change-emails/107374/5 "2023-02-24T07:13:59Z")