# Omniauth jwt redirect
**URL:** https://meta.discourse.org/t/omniauth-jwt-redirect/137348
**Category:** SSO
**Created:** [December 30, 2019, 6:11am UTC](https://meta.discourse.org/t/omniauth-jwt-redirect/137348 "2019-12-30T06:11:37Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@arivanandan](https://meta.discourse.org/u/arivanandan)
#### Post date: [December 30, 2019, 6:11am UTC](https://meta.discourse.org/t/omniauth-jwt-redirect/137348/1 "2019-12-30T06:11:37Z")
After [this](https://meta.discourse.org/t/discourse-sso-with-oauth2/132384), I’ve been able to get SSO up and running with JWT.
With the [discourse-omniauth-jwt library](https://github.com/discourse/discourse-omniauth-jwt), I’m not sure how to redirect people after sign-in.
When a user logs into my site, I obtain the JWT and sign them into discourse as well immediately. At the end of this flow, they end up at the discourse site instead of back at my site.
I have tried checking out the [omniauth library](https://github.com/omniauth/omniauth)’s redirection methods which includes the origin param and the destination\_url cookie from [here](https://github.com/discourse/discourse/blob/master/app/controllers/users/omniauth_callbacks_controller.rb#L43-L78). None of them seem to work.
Maybe @eviltrout can shed some light on this.
EDIT: Just realized I’ve been looking at two different libraries, omniauth and discourse’s omniauth callbacks. Anyway, still unsure how to make this work.
---
### Author:  [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [December 30, 2019, 4:38pm UTC](https://meta.discourse.org/t/omniauth-jwt-redirect/137348/2 "2019-12-30T16:38:02Z")
So the issue here is:
1. a user logs into your site
2. you redirect them to discourse to log in there
3. they end up logged in at discourse?
I don’t think this is a supported path. In general, a user would be on discourse, click login, visit your site for auth and be redirected back. If a user logs in directly on your site, they should stay on your site.
Typically how we do this is keep Discourse logged out, but when they click “Login” it’ll redirect back without having to fill out the authentication form again.
---
### Author:  [@arivanandan](https://meta.discourse.org/u/arivanandan)
#### Post date: [December 31, 2019, 10:34am UTC](https://meta.discourse.org/t/omniauth-jwt-redirect/137348/3 "2019-12-31T10:34:08Z")
Hmm right makes sense. Logging in doesn’t do much now that I think about it since the embed can’t make use of the auth session.
---
### Author:  [@arivanandan](https://meta.discourse.org/u/arivanandan)
#### Post date: [January 21, 2020, 7:28am UTC](https://meta.discourse.org/t/omniauth-jwt-redirect/137348/4 "2020-01-21T07:28:30Z")
So, the embeds do make use of the auth session (or the session cookie) to show or hide private discourse topics.
This auth flow does make sense, but for starters, I’m going to redirect people to the discourse forum for login on a new tab. They will be able to access private topics after a refresh.
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [December 1, 2023, 10:33pm UTC](https://meta.discourse.org/t/omniauth-jwt-redirect/137348/5 "2023-12-01T22:33:21Z")