Login to Discourse with custom Oauth2 provider

[poliveira89 (Paulo Oliveira)]

Your example will work with “OAuth1a” version?

[badevguru (Brian Adams)]

Just wanted to note that the solution does not work for hosted accounts that don’t have access to modify the source at the moment, exposing the Oauth2 configuration through the UI would be a really nice thing!

[Frans_Thamura]

can i know, how the fb login in discourse work? and which source logic?

we have our own Oauth2 server, www.github.com/meruvian/yama, and real online version is www.merv.id

We want to make discourse as our forum, so we want to change the login using merv.id, or may be using anyone that implement our Yama.

any idea?

[codinghorror (Jeff Atwood)]

@eviltrout this request does come up a fair bit, people want to use their existing oauth as sso. Any thoughts on that?

[sam (Sam Saffron)]

we can add “generic oauth settings” but the trouble is that each oauth provider is quirkily a bit different.

It works now fine with plugins.

[codinghorror (Jeff Atwood)]

Issue is we do not have plugins on std and biz hosting. So there would need to be a default oauth plugin.

[eviltrout (Robin Ward)]

I think we could try and create a default “generic” oauth plugin. Sam is right that each one I’ve done so far is slightly different but we could take a stab at extracting those differences into settings that people could configure.

I would need some example “plain” oauth sites to test out.

[eviltrout (Robin Ward)]

I took a stab at this this week and managed to come up with a Basic OAuth2 plugin that works. The caveat is you need to have a JSON endpoint on your server so that we can obtain other information about the user.

https://github.com/discourse/discourse-oauth2-basic

I tested it with SoundCloud as a provider, and it worked great. I’d love other people to give it a whirl and let me know feedback and I’m sure as we try it out with more providers we’ll find changes and configuration options that will be required.

[beanieboi]

hey!

thanks for the OAuth2 Provider. it’s working like a charm!
i have one question, which google couldn’t answer to me.
is it possible to combine the OAuth2 Plugin with the enable_sso plugin?

right now when i click the “login with provider” button it connects to our OAuth Provider and grabs all the information and pre-fills the registration form with the user data (like on meta.discourse.com, when i login with GitHub)
how can i skip the registration and directly create the account? so that the user doesn’t have to register again?

thanks for your help!
ben

[codinghorror (Jeff Atwood)]

No, SSO is mutually exclusive and disables local logins.

[taylorfayle]

@DanielMarquard Were you successful in getting SSO via Blackboard. I’m thinking Discourse could be a great alternative to BB discussions.

[DanielMarquard]

@taylorfayle

@DanielMarquard Were you successful in getting SSO via Blackboard. I’m thinking Discourse could be a great alternative to BB discussions.

I ended up not getting a contract for this project, so I didn’t pursue it further, but I think it could absolutely be done. Have you tried out the Discourse oAuth 2 plugin?

[leog (Leo Giovanetti)]

@codinghorror

No, SSO is mutually exclusive and disables local logins.

Is this still the case? I’ve been trying to close the same gap as @beanieboi described for so long to improve the experience and have a seamless experience for my customers but seems like there is no way around it. Any other suggestion to accomplish this?

Thanks in advance!

[codinghorror (Jeff Atwood)]

That is the case, that is the entire purpose of SSO – seamless magic login. Otherwise you want the oAuth 2 menu of providers.

[leog (Leo Giovanetti)]

Here is my problem: SSO vs Oauth2 difference?

Seems like I’m confusing things then, or maybe the use case I want to cover isn’t possible.

[supermathie (Michael Brown)]

SSO means: “I trust «other_site» to rely on ALL of my authentication and rely on it exclusively for this purpose.”

That other site could be anything - it could be your Corporate SSO site, it could be something horrible that trusts users completely, it could be a provider that requires an RSA key with certificates, heck it could even be (another) Discourse.

oauth2 means: “This is a login option for my site” such as Google oauth2.

If what you’re trying to do is this:

then you want to do as @sam mentioned and use the plugin (possibly extending it to specifically support your OAuth2 provider.

But if what you’re trying to do is this:

Then you need to write “SSO Provider” as Discourse doesn’t care what’s behind it.

[leog (Leo Giovanetti)]

Super clear. Thanks for taking the time to include diagrams, really neat!

[david (David Taylor)]

@beanieboi

how can i skip the registration and directly create the account?

@leog

seamless experience for my customers but seems like there is no way around it. Any other suggestion to accomplish this?

I just added some new settings which makes this possible:

Automatically provision accounts with external SSO provider? (skip Create New Account prompt)

I just added some new site settings which will help with this. To skip the ‘create new account’ screen, enable sso_overrides_username, sso_overrides_email and sso_overrides_name. Then to skip the popup completely, enable external_auth_skip_create_confirm If you don’t see that option, make sure you’re on the latest version of tests-passed.