# Erro de login ao tentar usar Discourse como provedor de identidade (SSO, DiscourseConnect)

**URL:** https://meta.discourse.org/t/login-error-while-trying-to-use-discourse-as-an-identity-provider-sso-discourseconnect/266603
**Category:** SSO
**Created:** [30 Maio , 2023 13:28 UTC](https://meta.discourse.org/t/login-error-while-trying-to-use-discourse-as-an-identity-provider-sso-discourseconnect/266603 "2023-05-30T13:28:38Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![ygramoel](https://avatars.discourse-cdn.com/v4/letter/y/74df32/32.png) [@ygramoel](https://meta.discourse.org/u/ygramoel)
#### Post date: [30 Maio , 2023 13:28 UTC](https://meta.discourse.org/t/login-error-while-trying-to-use-discourse-as-an-identity-provider-sso-discourseconnect/266603/1 "2023-05-30T13:28:38Z")

</div>

Estou tentando seguir este post: [Use Discourse as an identity provider (SSO, DiscourseConnect)](https://meta.discourse.org/t/use-discourse-as-an-identity-provider-sso-discourseconnect/32974/1) usando código Python. O código Python abaixo imprime um URL que - até onde posso ver - deveria estar corretamente assinado para acessar [https://forum.embeetle.com/session/sso\_provider](https://forum.embeetle.com/session/sso_provider) na minha instância Discourse, mas, em vez disso, mostra apenas o texto “Login Error”.

Não há erro nos logs em [https://forum.embeetle.com/logs](https://forum.embeetle.com/logs), então não tenho ideia de como resolver isso. Isso significa que a assinatura está incorreta? Alguma outra sugestão?

A propósito, não se preocupe: mudarei o segredo SSO assim que este problema for resolvido.

```plaintext
import secrets
import base64
import urllib.parse
import hmac
import hashlib

forum_url = 'https://forum.embeetle.com'
target_url = 'https://embeetle.com/#account'
sso_secret = b'JCLSVcqbAnEPXz2p2xBY'

nonce = secrets.token_urlsafe()
payload = f'nonce={nonce}&return_sso_url={target_url}'
payload_base64 = base64.b64encode(payload.encode('utf-8')).decode()
payload_for_url = urllib.parse.quote(payload_base64)
signature = hmac.new(
    sso_secret, payload_for_url.encode('utf-8'), hashlib.sha256
).hexdigest()

print(f'{forum_url}/session/sso_provider?sso={payload_for_url}&sig={signature}')

```

Este código gera um link como o do comando curl abaixo:

```plaintext
johan@morla:~/sa\> curl 'https://forum.embeetle.com/session/sso_provider?sso=bm9uY2U9bExhRUZjRGFVd0NrNTFkMEVOeGc5dUtKZ0kwNHZNYng5VkpFR0RqRUg0OCZyZXR1cm5fc3NvX3VybD1odHRwczovL2VtYmVldGxlLmNvbS8jYWNjb3VudA%3D%3D&sig=70e647a1baad2e09ef6cdc6d87fae70bc27c6823369be20fd1b11ea536180343'
Login Errorjohan@morla:~/sa\> 

```

Aqui está uma captura de tela das configurações no site:

 ![image](https://global.discourse-cdn.com/meta/original/4X/2/9/9/2990c4604eebadb0dd15d5fa149716b0b4bc58a5.png)

O que está errado, ou como posso depurar isso?

---

<div class="post-metadata">

### Author: ![ygramoel](https://avatars.discourse-cdn.com/v4/letter/y/74df32/32.png) [@ygramoel](https://meta.discourse.org/u/ygramoel)
#### Post date: [30 Maio , 2023 15:45 UTC](https://meta.discourse.org/t/login-error-while-trying-to-use-discourse-as-an-identity-provider-sso-discourseconnect/266603/2 "2023-05-30T15:45:35Z")

</div>

Um passo adiante: se eu ativar o registro detalhado para [DiscourseConnect](https://meta.discourse.org/t/13045?silent=true), recebo um erro nos logs:

![image](https://cdck-file-uploads-global.s3.dualstack.us-west-2.amazonaws.com/meta/optimized/4X/3/4/a/34a67ebc64f104f8f8096d7cf9b0a2bf51abdb7a_2_690x71.png)

```plaintext
Log detalhado do SSO: Erro de análise de assinatura Assinatura inválida para a carga útil sso: bm9uY2U9YklKeEU1WWw2OFhjSkJydGlwSU15UTRZeVlMeWd6ZzQyUU9mOFo0SWF5QSZyZXR1cm5fc3NvX3VybD1odHRwczovL2VtYmVldGxlLmNvbS8jYWNjb3VudA= 

```

Um ponto notável é que a carga útil mencionada no log não está codificada em URL (note o ‘=’ no final) e está faltando o segundo ‘=’ dos dados codificados em URL (note o `%3D` repetido no final da carga útil original).

---

<div class="post-metadata">

### Author: ![ygramoel](https://avatars.discourse-cdn.com/v4/letter/y/74df32/32.png) [@ygramoel](https://meta.discourse.org/u/ygramoel)
#### Post date: [30 Maio , 2023 15:50 UTC](https://meta.discourse.org/t/login-error-while-trying-to-use-discourse-as-an-identity-provider-sso-discourseconnect/266603/3 "2023-05-30T15:50:23Z")

</div>

Entendido: a assinatura HMAC-SHA256 deve ser calculada a partir dos dados codificados em base64, e não dos dados codificados em URL. Portanto, o código correto é:

```plaintext
import secrets
import base64
import urllib.parse
import hmac
import hashlib

forum_url = 'https://forum.embeetle.com'
target_url = 'https://embeetle.com/#account'
sso_secret = b'JCLSVcqbAnEPXz2p2xBY'

nonce = secrets.token_urlsafe()
payload = f'nonce={nonce}&return_sso_url={target_url}'
payload_base64 = base64.b64encode(payload.encode('utf-8')).decode()
payload_for_url = urllib.parse.quote(payload_base64)

signature = hmac.new(
    sso_secret, payload_base64.encode('utf-8'), hashlib.sha256
).hexdigest()

print(f'{forum_url}/session/sso_provider?sso={payload_for_url}&sig={signature}')

```

Agora para o restante do trabalho: lidar com o redirecionamento, verificar o nonce, etc. A continuar…

---

<div class="post-metadata">

### Author: ![system](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/system/32/443519_2.png) [@system](https://meta.discourse.org/u/system)
#### Post date: [29 Junho , 2023 15:50 UTC](https://meta.discourse.org/t/login-error-while-trying-to-use-discourse-as-an-identity-provider-sso-discourseconnect/266603/4 "2023-06-29T15:50:43Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.