# Security implications of exposed SSO Secret in multi-user install? **URL:** \ **Category:** WordPress\ **Created:** [2015 年5 月 21 日 20:39 UTC](https://meta.discourse.org/t/security-implications-of-exposed-sso-secret-in-multi-user-install/29092 "2015-05-21T20:39:00Z")\ **Posts on this page:** 1\ **Showing post:** 1
作者： ![jetatomic](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jetatomic/32/42202_2.png) [@jetatomic](https://meta.discourse.org/u/jetatomic)\ 发布日期： [2015 年5 月 21 日 20:39 UTC](https://meta.discourse.org/t/security-implications-of-exposed-sso-secret-in-multi-user-install/29092/1 "2015-05-21T20:39:00Z")
What security risks may be involved with others knowing the sso secret? My WordPress install is multisite and multiuser. There doesn’t seem to be a way to set Discourse settings at the _network_ level from the WP plugin. This doesn’t seem to be a huge problem otherwise (though it would smooth workflow), but I can’t find a way to prevent the _subsite_ admins from having access to the plugin settings, which include the sso secret. Discourse is using the network level user table as the endpoint so that the Discourse users are basically an aggregate of all sites. I’d rather not provide access or security holes for subsite admins to see the full network user list/details. All of the subsite admins do not have admin/moderator privileges in Discourse. In effect, my Discourse admin privileges are more like _Super Admin_ privileges in Wordpress multi-site, and the lack of plugin settings at the network level blurs this line. Have I simply failed to discover the plugin’s network level settings? If not, is anyone working on improving Wordpress multisite compatibility? --- _[View the full topic](https://meta.discourse.org/t/security-implications-of-exposed-sso-secret-in-multi-user-install/29092)._