Setup DiscourseConnect - Official Single-Sign-On for Discourse (sso)

[simon]

@eric_wa

Is it just that it enables automated spamming?

The worst case scenario I’m aware of requires these conditions:

• email addresses are not verified on the external site
• require_activation=true is not set in the SSO payload
• there are existing accounts on the Discourse site that do not have a SingleSignOnRecord associated with them (the account owner has never logged into Discourse with SSO)

For that case, someone could signup on the external site using the email address of a Discourse user who has never signed in with SSO. This would allow the unverified account from the external site to take over the Discourse account that uses the same email address. This would be especially concerning if it was an admin account on Discourse.

@eric_wa

Why is it not recommended that Discourse handles email verification if the external site does not?

It is recommended that Discourse handles email verification if the external site isn’t handling it:

@Discourse

Alternatively, if you insist on sending unvalidated emails BE SURE to set require_activation=true, this will force all emails to be validated by Discourse. WE STILL STRONGLY ADVISE THAT YOU DO NOT DO THIS, so if you proceed with that setting enabled, you are assuming substantial risk.

There are a couple of reasons that it’s better to handle email verification on the external site though:

• forcing users to receive the confirmation email from Discourse adds some friction when users first attempt to login to Discourse. (Realistically, that friction has to happen somewhere though - either on the Discourse end or on the external site’s end.)
• Discourse won’t match existing Discourse accounts to external logins based on the email address if require_activation is set to true in the SSO payload. This is an issue if you enable DiscourseConnect after some accounts have been created on Discourse by registering with a username/password. It’s also an issue if for any reason you ever need to delete SingleSignOnRecord entries on Discourse. Discourse won’t automatically create new SingleSignOnRecord entries when users attempt to log back into Discourse.