Is "partial" SSO possible?

[rodypl (Rodolphe)]

I’m not a developer, so I don’t even know what to search to find the answer to my question. I’m currently trialing Discourse right now and how users log in have been on my mind a lot.

At the start of my trial I was convinced SSO was the way I would go once my trial was over, but now I’m not so sure. It seems like I’d lose some nice Discourse features if I enabled SSO (like the invite features) and I don’t know if there advantage in my case is worth it.

Is it possible to have my forum use both the built in Discourse accounts AND my site’s account? Similar to how you can set up “or Log in with Facebook/Google/Apple” options?

You know how when a user tries to log in/create an account they’re presented with the email/password fields, but on the right of that it gives them options to log in with Facebook, Google, etc? Could I simply have my site’s account be one of these options on the right?

So if a user just wants to use my main site’s login and not create a new account specifically for the forum they could, but they wouldn’t be required for it.

Is this possible? And is this advisable? As in, are there any reasons why I shouldn’t go this route? Thanks!

[david (David Taylor)]

@rodypl

You know how when a user tries to log in/create an account they’re presented with the email/password fields, but on the right of that it gives them options to log in with Facebook, Google, etc? Could I simply have my site’s account be one of these options on the right?

It depends on what you mean by “SSO”. If you’re talking about DiscourseConnect - Official Single-Sign-On for Discourse (sso), then you cannot use it alongside other login options.

If you’re talking about OAuth2, OpenID Connect, or any of our other authentication plugins, then yes they can be used alongside each other, and alongside email/password login.

@rodypl

(like the invite features)

Good news on that front - we’ve recently added invite support for DiscourseConnect

FEATURE: Allow using invites when DiscourseConnect SSO is enabled (#12419)

And for other login methods:

FEATURE: Allow invites redemption with Omniauth providers.

These changes are live in the latest version of Discourse

[pfaffman (Jay Pfaffman)]

You can do that by implementing oauth2 on your server so that it could function like Google and github and friends. (Or having someone do that, since you’re not a developer.)

[rodypl (Rodolphe)]

@david

If you’re talking about OAuth2, OpenID Connect, or any of our other authentication plugins, then yes they can be used alongside each other, and alongside email/password login.

Thanks! Could you link me to documentation about that please?

[david (David Taylor)]

Those two plugins can be found at:

OpenID Connect Authentication Plugin

Summary: discourse-openid-connect allows an OpenID Connect provider to be used as an authentication provider for Discourse. GitHub: https://github.com/discourse/discourse-openid-connect Install: Follow the plugin installation guide. Features The plugin aims to provide a minimal implementation of the specification. Specifically, it supports the “Authorization Code Flow”. To get started, follow the plugin installation instructions, or contact your hosting provider. Our o…

OAuth2 Basic Support

The goal of the plugin is to support basic OAuth2 providers assuming they have a JSON API endpoint where user details can be retrieved by token. GitHub: https://github.com/discourse/discourse-oauth2-basic Install: Follow the plugin installation guide. Features This plugin allows you to use a basic OAuth2 provider as authentication for Discourse. It should work with many providers, with the caveat that they must provide a JSON endpoint for retrieving information about t…