# Set up your DiscourseConnect(DiscourseSSO) to SimpleSAMLphp, use your Discourse forum as a SAML IDP (Identify Provider)

**URL:** https://meta.discourse.org/t/set-up-your-discourseconnect-discoursesso-to-simplesamlphp-use-your-discourse-forum-as-a-saml-idp-identify-provider/213654
**Category:** Extras
**Created:** [January 2, 2022, 8:04pm UTC](https://meta.discourse.org/t/set-up-your-discourseconnect-discoursesso-to-simplesamlphp-use-your-discourse-forum-as-a-saml-idp-identify-provider/213654 "2022-01-02T20:04:36Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![tachibanalolo](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/tachibanalolo/32/233762_2.png) [@tachibanalolo](https://meta.discourse.org/u/tachibanalolo)
#### Post date: [January 2, 2022, 8:04pm UTC](https://meta.discourse.org/t/set-up-your-discourseconnect-discoursesso-to-simplesamlphp-use-your-discourse-forum-as-a-saml-idp-identify-provider/213654/1 "2022-01-02T20:04:36Z")

</div>

Discourse has intergrated a [DiscourseConnect](https://meta.discourse.org/t/13045?silent=true) that allows you to change your Discourse into a SSO provider. You can find it in [“Using Discourse as an identity provider (SSO, DiscourseConnect)”](https://meta.discourse.org/t/using-discourse-as-an-identity-provider-sso-discourseconnect/32974) this article. However what it provides is not a standard SAML or Oauth protocol.

So we need to use a [module](https://meta.discourse.org/t/using-discourse-as-an-identity-provider-sso-discourseconnect/32974/105) that created by Paul B. in Discourse forum. This is a module that allows us connect [DiscourseConnect](https://meta.discourse.org/t/13045?silent=true) to SimpleSAMLphp and then use SimpleSAMLphp to provide standard SAML login service protocol. In here I want to give great thanks for his help that allows this to real. You can also find the module in here:

> [@Discourse SSO via a SimpleSAMLphp authentication module (IdP)](https://meta.discourse.org/t/discourse-sso-via-a-simplesamlphp-authentication-module-idp/165810):
>
> Hi wave, I wrote this SimpleSAMLphp authentication module to be able to use Discourse as an SSO provider within a SimpleSAMLphp installation. I.e. you can use Discourse as an SSO provider for any services that supports SAML or Shibboleth authentication, which is really nice. [https://github.com/swcc/simplesamlphp-module-authdiscourse](https://github.com/swcc/simplesamlphp-module-authdiscourse) Let me know what you think (if interested to comment on the code you can use Github Issues) slightly_smiling_face

## Now let’s start the guide.

First, we need to config SimpleSAMLphp.

Download SimpleSAMLphp first.

```plaintext
wget https://simplesamlphp.org/download?latest

```

And then unzip.

```plaintext
tar zxf download?latest

```

Then move file to /var/simplesamlphp.

```plaintext
sudo cp -a simplesamlphp-1.x.y/. /var/simplesamlphp/

```

Then give this folder to www-data user and 755 permission.

```plaintext
sudo chown -R www-data:www-data /var/simplesamlphp/
sudo chmod -R 755 /var/simplesamlphp/

```

You may ask why the path must be in /var/simplesamlphp, because offcial documentation is put in here, you will need extra config if you put it into other place.

Then config nginx and point the index to /www in its folder. If you using apache, please find config in offcial documentation.

```nginx
upstream saml-php-handler {
    server unix:/run/php/php8.0-fpm.sock;
}

server {
        listen 443 ssl;
        server_name YOUR_SAML_DOMAIN;
        index index.php;
        ssl_certificate YOUR_CERT;
        ssl_certificate_key YOUR_KEY;
        ssl_protocols TLSv1.3 TLSv1.2;
        ssl_ciphers EECDH+AESGCM:EDH+AESGCM;
        location ^~ /simplesaml {
            alias /var/simplesamlphp/www;
            location ~ ^(?<prefix>/simplesaml)(?<phpfile>.+?\.php)(?<pathinfo>/.*)?$ {
                include fastcgi_params;
                fastcgi_pass saml-php-handler;
                fastcgi_param SCRIPT_FILENAME $document_root$phpfile;
                # Must be prepended with the baseurlpath
                fastcgi_param SCRIPT_NAME /simplesaml$phpfile;
                fastcgi_param PATH_INFO $pathinfo if_not_empty;
            }
        }
}

```

Then update your source:

```plaintext
sudo apt update

```

Then install software package:

```plaintext
sudo apt install php-xml php-mbstring php-curl php-memcache php-ldap memcached

```

Notice: Here requires you to install according to your php version. For example, if you are using php8.0, you will need to add “8.0” after all “php”. Like: php8.0-xml

Restart Nginx to activate new php extension after install has been completed:

```plaintext
sudo systemctl restart Nginx

```

Then generate a salt:

```plaintext
openssl rand -base64 32

```

Copy this salt.

Then open /var/simplesamlphp/config/config.php

```php
'auth.adminpassword'，YOUR_PASSWORD；
'secretsalt'，YOUR_SALT；
'technicalcontact_name'，YOUR_NAME；
'technicalcontact_email' ，YOUR_EMAIL；
 'language.default'，CHANGE_TO_YOUR_LANGUAGE;
'timezone'，CHANGE_TO_YOUR_AREA；
'enable.saml20-idp' => true,

```

Then open https://YOUR\_SAML\_DOMAIN/simplesaml, theoretically your SimpleSAMLphp should working now.

Then install Composer.

```plaintext
php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"

```

```plaintext
php composer-setup.php

```

```plaintext
sudo mv composer.phar /usr/bin/composer

```

Then you should type composer to run.

Go to /var/simplesamlphp, edit composer.json, change version to dev-master.

The reason why it do it here is because the discourse-simplesamlphp module requires “dev-master” version, however its default version is number, so we need to change the version to “dev-master”.

Then start to install this module.

```plaintext
composer require swcc/simplesamlphp-module-authdiscourse dev-master --ignore-platform-reqs

```

The parameter “–ignore-platform-reqs” is to prevent your php version not match the requirement.

Now you should see composer start to install swcc/simplesamlphp-module-authdiscourse.

After install completed, input:

```plaintext
touch /var/simplesamlphp/modules/authdiscourse/enable

```

To enable this plugin.

Then enable “[discourse connect](https://meta.discourse.org/t/13045?silent=true) provider secrets” and “enable [discourse connect](https://meta.discourse.org/t/13045?silent=true) provider” these two options in your Discourse forum.

In “[discourse connect](https://meta.discourse.org/t/13045?silent=true) provider secrets” input your SAML domain and a sso secret.

Then edit config/authsources.php in simplesamlphp folder:

```php
<?php
$config = [
    // This is a authentication source which handles admin authentication.
    'admin' => [
        'core:AdminPassword',
    ],

    // This is the authentication source using the Discourse authentication.
    'discourse-sso' => [
      'authdiscourse:Discourse',
      'url' => 'https://discourse.your-domain.org',
      'secret' => '<your-sso-secret>',
    ],

];

```

You need to add this part into suitable place:

```php
    'discourse-sso' => [
      'authdiscourse:Discourse',
      'url' => 'YOUR_DISCOURSE_DOMAIN',
      'secret' => 'DISCOURSE_SSO_SECRET',
    ],

```

To allow SimpleSAMLphp use discourse-sso for authentication.

Finally, open https://YOUR\_SAML\_DOMAIN/simplesaml/module.php/core/authenticate.php?as=discourse-sso

OR

Open https://YOUR\_SAML\_DOMAIN/simplesaml/ then click authentication then clickdiscourse-sso to test.

If it returns correct information, then it means you have successfully configure your SimpleSAMLphp connect to your Discourse.

Now you need to configure your IDP settings.

First you need to generate a certificate for IDP using:

```plaintext
openssl req -newkey rsa:3072 -new -x509 -days 3652 -nodes -out YOUR_SAML_DOMAIN.crt -keyout YOUR_SAML_DOMAIN.pem

```

If you generate it at root directory, you can see your new cert in there.

Then move your cert to whatever to want to place, then give them to user www-data and 755 permission.

```plaintext
chown -R www-data:www-data /YOUR_CERT_PATH
chmod -R 755 /YOUR_CERT_PATH

```

Finally, edit your cert path and your auth source in metadata/saml20-idp-hosted.php.

```plaintext
<?php
$metadata[' __DYNAMIC:1__'] = [
    /*
     * The hostname for this IdP. This makes it possible to run multiple
     * IdPs from the same configuration. ' __DEFAULT__' means that this one
     * should be used by default.
     */
    'host' => ' __DEFAULT__',

    /*
     * The private key and certificate to use when signing responses.
     * These are stored in the cert-directory.
     */
    'privatekey' => '/YOUR_KEY_PATH',
    'certificate' => '/YOUR_CERT_PATH',
    /*

     * The authentication source which should be used to authenticate the
     * user. This must match one of the entries in config/authsources.php.
     * NOTICE: YOU NEED TO CHANGE THE AUTH METHOD TO "discourse-sso"
     */
    'auth' => 'discourse-sso',
];

```

Now your SimpleSAMLphp is using Discourse as user database backend, as a SAML IDP, providing standard SAML login protocol.

IDP ID(URI)：https://YOUR\_SAML\_DOMAIN/simplesaml/saml2/idp/metadata.php

URL Target(Use to send SP identify Requirement)：https://YOUR\_SAML\_DOMAIN/simplesaml/saml2/idp/SSOService.php

X509 Cert：https://YOUR\_SAML\_DOMAIN/simplesaml/module.php/saml/idp/certs.php/idp.crt

Or for those SP that allows you to upload IDP Metadata file directly, you can download IDP Metadata：https://YOUR\_SAML\_DOMAIN/simplesaml/saml2/idp/metadata.php

All done. Everything should be working now.

enjoy~

Next I may introduce how to connect SimpleSAMLphp that powered by Discourse as NextCloud’s SAML login way.

Anything that misunderstood can reply this post or contact me via [admin@rail.moe](mailto:admin@rail.moe).

---

<div class="post-metadata">

### Author: ![cookieman768](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/cookieman768/32/118511_2.png) [@cookieman768](https://meta.discourse.org/u/cookieman768)
#### Post date: [January 4, 2022, 7:17am UTC](https://meta.discourse.org/t/set-up-your-discourseconnect-discoursesso-to-simplesamlphp-use-your-discourse-forum-as-a-saml-idp-identify-provider/213654/2 "2022-01-04T07:17:26Z")

</div>

Thank you for this guide! I’m actually really interested in making this switch! I didn’t fully understand how to set this up but, I’m going to give it a shot when I get the chance.

---

<div class="post-metadata">

### Author: ![jakob42](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jakob42/32/193926_2.png) [@jakob42](https://meta.discourse.org/u/jakob42)
#### Post date: [April 9, 2024, 1:49pm UTC](https://meta.discourse.org/t/set-up-your-discourseconnect-discoursesso-to-simplesamlphp-use-your-discourse-forum-as-a-saml-idp-identify-provider/213654/3 "2024-04-09T13:49:50Z")

</div>

Hey, did anybody try this recently? I’m running discourse 3.3 and simpleSAMLphp 2.2.1 and cannot get it to work. I’m at the testing step. The link doesnt work anymore, but I found a test option in simplesamls admin panel. But I’m getting this exeption here:

```plaintext
SimpleSAML\Error\Error: UNHANDLEDEXCEPTION
Backtrace:
3 src/SimpleSAML/Error/ExceptionHandler.php:35 (SimpleSAML\Error\ExceptionHandler::customExceptionHandler)
2 vendor/symfony/error-handler/ErrorHandler.php:535 (Symfony\Component\ErrorHandler\ErrorHandler::handleException)
1 vendor/symfony/error-handler/ErrorHandler.php:627 (Symfony\Component\ErrorHandler\ErrorHandler::handleFatalError)
0 [builtin] (N/A)
Caused by: Symfony\Component\ErrorHandler\Error\FatalError: Compile Error: Declaration of SimpleSAML\Module\authdiscourse\Auth\Source\Discourse::authenticate(&$state) must be compatible with SimpleSAML\Auth\Source::authenticate(array &$state): void
Backtrace:
0 modules/authdiscourse/lib/Auth/Source/Discourse.php:73 (N/A)

```

I checked all the steps multiple times, but the module hasn’t been updated in 4 years and I fear it isn’t compatible anymore. Is anybody still using this?

---

<div class="post-metadata">

### Author: ![dennisjbr](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/dennisjbr/32/444916_2.png) [@dennisjbr](https://meta.discourse.org/u/dennisjbr)
#### Post date: [August 30, 2024, 1:21am UTC](https://meta.discourse.org/t/set-up-your-discourseconnect-discoursesso-to-simplesamlphp-use-your-discourse-forum-as-a-saml-idp-identify-provider/213654/4 "2024-08-30T01:21:25Z")

</div>

> [@tachibanalolo](#):
>
> However what it provides is not a standard SAML or Oauth protocol.

So what protocol does [DiscourseConnect](https://meta.discourse.org/t/13045?silent=true) use? I was trying an oAuth2 client but realized the parameters are not quite the same ☹