# OpenID Connect and SSO
**URL:** https://meta.discourse.org/t/openid-connect-and-sso/175372
**Category:** SSO
**Tags:** openid-connect
**Created:** [January 7, 2021, 11:35am UTC](https://meta.discourse.org/t/openid-connect-and-sso/175372 "2021-01-07T11:35:27Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@tdudgeon](https://meta.discourse.org/u/tdudgeon)
#### Post date: [January 7, 2021, 11:35am UTC](https://meta.discourse.org/t/openid-connect-and-sso/175372/1 "2021-01-07T11:35:27Z")
I’m wanting to use OpenID Connect (Keycloak) as SSO solution with Discourse as one of the clients.
I have the OpenID Connect Authentication Plugin installed and working in Discourse, but there seem to be some aspects of SSO that are not applied and I’m not sure to what extent the features of SSO and this OIDC plugin overlap.
According to [SSO synced login state tips](https://meta.discourse.org/t/sso-synced-login-state-tips/60464) it should be possible to login directly using SSO with a URL like `fourm.example.com/session/sso` but that does not seem to be present with just the OpenID Connect Authentication Plugin and trying to also setup the enable\_sso and sso\_url options ended up with a broken setup.
How is one supposed to use OIDC with SSO?
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [January 7, 2021, 11:43am UTC](https://meta.discourse.org/t/openid-connect-and-sso/175372/2 "2021-01-07T11:43:02Z")
In discourse “SSO” means this protocol: [Setup DiscourseConnect - Official Single-Sign-On for Discourse (sso)](https://meta.discourse.org/t/discourseconnect-official-single-sign-on-for-discourse-sso/13045) (we are working on renaming it to [DiscourseConnect](https://meta.discourse.org/t/13045?silent=true)… because it’s super confusing at the moment!)
To use openid-connect, do not use `enable_sso` or `sso_url`
> [@tdudgeon](#):
>
> login directly using SSO with a URL
If openid-connect is the only enabled login method, then sending the user to `/login` should start the authentication flow.
---
### Author:  [@tdudgeon](https://meta.discourse.org/u/tdudgeon)
#### Post date: [January 7, 2021, 11:52am UTC](https://meta.discourse.org/t/openid-connect-and-sso/175372/3 "2021-01-07T11:52:16Z")
OK, thanks. Does that man that the default built-in (username/password in Discourse) authentication needs to be disabled? Or can that be kept as an option?
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [January 7, 2021, 11:53am UTC](https://meta.discourse.org/t/openid-connect-and-sso/175372/4 "2021-01-07T11:53:52Z")
It’s up to you. You can control it using the `enable_local_logins` setting.
If you leave it enabled, then visiting `/login` will present the user with a choice of login options. If you disable it, openid-connect will be started immediately.
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [February 6, 2021, 11:53am UTC](https://meta.discourse.org/t/openid-connect-and-sso/175372/5 "2021-02-06T11:53:52Z")
This topic was automatically closed 0 minutes after the last reply. New replies are no longer allowed.