# Setup DiscourseConnect - Official Single-Sign-On for Discourse (sso)

**URL:** <https://meta.discourse.org/t/setup-discourseconnect-official-single-sign-on-for-discourse-sso/13045>\
**Category:** Integrations\
**Tags:** sso, discourseconnect, configuring, how-to\
**Created:** [February 25, 2014, 8:30am UTC](https://meta.discourse.org/t/setup-discourseconnect-official-single-sign-on-for-discourse-sso/13045 "2014-02-25T08:30:34Z")\
**Posts on this page:** 1\
**Showing post:** 584

<div class="post-metadata">

**Author:** ![simon](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/simon/32/339122_2.png) [@simon](https://meta.discourse.org/u/simon)\
**Post date:** [September 12, 2024, 5:24am UTC](https://meta.discourse.org/t/setup-discourseconnect-official-single-sign-on-for-discourse-sso/13045/584 "2024-09-12T05:24:50Z")

</div>

> [@eric\_wa](#):
>
> Is it just that it enables automated spamming?

The worst case scenario I’m aware of requires these conditions:

- email addresses are not verified on the external site
- `require_activation=true` is not set in the SSO payload
- there are existing accounts on the Discourse site that do not have a `SingleSignOnRecord` associated with them (the account owner has never logged into Discourse with SSO)

For that case, someone could signup on the external site using the email address of a Discourse user who has never signed in with SSO. This would allow the unverified account from the external site to take over the Discourse account that uses the same email address. This would be especially concerning if it was an admin account on Discourse.

> [@eric\_wa](#):
>
> Why is it not recommended that Discourse handles email verification if the external site does not?

It _is_ recommended that Discourse handles email verification if the external site isn’t handling it:

> [@Discourse](#):
>
> Alternatively, if you insist on sending unvalidated emails **BE SURE** to set `require_activation=true`, this will force all emails to be validated by Discourse. WE STILL STRONGLY ADVISE THAT YOU DO NOT DO THIS, so if you proceed with that setting enabled, you are assuming substantial risk.

There are a couple of reasons that it’s better to handle email verification on the external site though:

- forcing users to receive the confirmation email from Discourse adds some friction when users first attempt to login to Discourse. (Realistically, that friction has to happen somewhere though - either on the Discourse end or on the external site’s end.)
- Discourse won’t match existing Discourse accounts to external logins based on the email address if `require_activation` is set to `true` in the SSO payload. This is an issue if you enable [DiscourseConnect](https://meta.discourse.org/t/13045?silent=true) after some accounts have been created on Discourse by registering with a username/password. It’s also an issue if for any reason you ever need to delete `SingleSignOnRecord` entries on Discourse. Discourse won’t automatically create new `SingleSignOnRecord` entries when users attempt to log back into Discourse.

---

_[View the full topic](https://meta.discourse.org/t/setup-discourseconnect-official-single-sign-on-for-discourse-sso/13045)._