# Silent login/signup via Auth0
**URL:** https://meta.discourse.org/t/silent-login-signup-via-auth0/83163
**Category:** SSO
**Created:** [3월 16, 2018, 5:52오후 UTC](https://meta.discourse.org/t/silent-login-signup-via-auth0/83163 "2018-03-16T17:52:34Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@shahidmir](https://meta.discourse.org/u/shahidmir)
#### Post date: [3월 16, 2018, 5:52오후 UTC](https://meta.discourse.org/t/silent-login-signup-via-auth0/83163/1 "2018-03-16T17:52:35Z")
Hi
I am trying to achieve SSO for the following scenario.
My application authenticates users agains auth0. Once authenticated, whenever the user visits the discourse page, I expect the user to be logged in silently without having to re-enter credentials (using the credentials from the initial login to my application).
Has anyone tackled this scenario?
Currently i have an Auth0 rule that upon authentication re-directs to discourse via the /sso/ path, passing the sso credentials from Auth0. This logs the user in, or creates the discourse account and then logs user in for a new discourse user.
But I want to achieve this without the Auth0 redirect so the experience to the user is seamless and he/she is already logged in when deciding to visit the discourse page.
Any assistance would be appreciated.
The same issue has been raised here, but there was no solutions proposed:
> [@Log in a user via the API](https://meta.discourse.org/t/log-in-a-user-via-the-api/42862/5):
>
> Hmm that is ugly, but may be necessary. I hope there could be a different way.
Regards
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [3월 16, 2018, 6:14오후 UTC](https://meta.discourse.org/t/silent-login-signup-via-auth0/83163/2 "2018-03-16T18:14:46Z")
This works if you make your site `login required`.
However you lose the ability to be crawled by search engines.
---
### Author:  [@fadymak](https://meta.discourse.org/u/fadymak)
#### Post date: [3월 22, 2018, 2:39오후 UTC](https://meta.discourse.org/t/silent-login-signup-via-auth0/83163/3 "2018-03-22T14:39:28Z")
Hey @shahidmir 👋 Just wanted to jump in with a quick comment: your best bet is to set up a RWA in Auth0 and use the official [Discourse OAuth 2 Basic Plugin](https://github.com/discourse/discourse-oauth2-basic).
We, at Auth0, have a similar setup where our customers can login to the Auth0 Dashboard, Support Center, and Community with a single Auth0 account. If the user has already created a session with your app, your Auth0 tenant will automatically return them to Discourse with the `access_token` without prompting them for their credentials.
You can take a look at how we set it up at [community.auth0.com](http://community.auth0.com)
I hope that helps 🙂
---
### Author:  [@shahidmir](https://meta.discourse.org/u/shahidmir)
#### Post date: [3월 27, 2018, 8:47오전 UTC](https://meta.discourse.org/t/silent-login-signup-via-auth0/83163/4 "2018-03-27T08:47:37Z")
hi, thanks very much for that.
regards
shahid
---
### Author:  [@RCheesley](https://meta.discourse.org/u/RCheesley)
#### Post date: [4월 26, 2018, 5:13오후 UTC](https://meta.discourse.org/t/silent-login-signup-via-auth0/83163/5 "2018-04-26T17:13:25Z")
Hi @fadymak, thanks for the info.
A walk through would be super helpful on how to set up this integration more fully.
I’ve managed to fumble my way through with a combination of the readme from the OAuth2 plugin and video tutorial on the Auth0 site, but I’m a bit stuck on the JSON User Endpoint part here: [GitHub - discourse/discourse-oauth2-basic: A basic OAuth2 plugin for use with Discourse · GitHub](https://github.com/discourse/discourse-oauth2-basic#part-2-configuring-the-json-user-endpoint)
These fields don’t seem to correspond with anything I can easily track down in Auth0.
Any guidance gratefully received!
Ruth
---
### Author:  [@RCheesley](https://meta.discourse.org/u/RCheesley)
#### Post date: [4월 30, 2018, 12:07오후 UTC](https://meta.discourse.org/t/silent-login-signup-via-auth0/83163/6 "2018-04-30T12:07:28Z")
For anyone else who gets stuck, I received the following from Auth0 support:
> Hi Ruth,
>
> In this case, the fields map as follows:
>
> `oauth2 json user id` : `user_id`
> `oauth2 json username` : `username`
> `oauth2 json name` : `name`
> `oauth2 json email` : `email`
>
> The `oauth2_user_json_url` would be the [userinfo endpoint](https://auth0.com/docs/api/authentication#get-user-info), e.g., `https://your-instance.auth0.com/userinfo` .
>
> You don’t need to specify the `:token` placeholder as the endpoint consumes the token via the `Authorization: Bearer` header.
---
### Author:  [@shahidmir](https://meta.discourse.org/u/shahidmir)
#### Post date: [5월 16, 2018, 11:55오전 UTC](https://meta.discourse.org/t/silent-login-signup-via-auth0/83163/7 "2018-05-16T11:55:03Z")
Hi fady,
After trying a few different approaches, I have finally come back to this approach you suggested 🙂
It all hangs together nicely now, expect one thing.
After the first successful login (after account creation in discourse), when i try to login again, the lock widget opens up with credentials pre-populated. When i accept these credential and click on email/username, the login does not succeed because the json endpoint is returning empty results for the userinfo endpoint.
Im assuming this is because the correct scopes are not passed?
Is there any additional config that i need to set in discourse or auth0 for this?
regards
---
### Author:  [@shahidmir](https://meta.discourse.org/u/shahidmir)
#### Post date: [5월 16, 2018, 12:01오후 UTC](https://meta.discourse.org/t/silent-login-signup-via-auth0/83163/8 "2018-05-16T12:01:12Z")
@fadymak seems like i can get around this issue by adding the “openid” scope to the API that im using in auth0.
Is this the correct approach?
---
### Author:  [@blake](https://meta.discourse.org/u/blake)
#### Post date: [5월 29, 2018, 4:30오후 UTC](https://meta.discourse.org/t/silent-login-signup-via-auth0/83163/9 "2018-05-29T16:30:29Z")
A post was merged into an existing topic: [How to use Auth0 with the OAuth2 Basic Plugin](https://meta.discourse.org/t/how-to-use-auth0-with-the-oauth2-basic-plugin/64633/20)