# SSO and embedding

**URL:** https://meta.discourse.org/t/sso-and-embedding/128659
**Category:** SSO
**Created:** [September 16, 2019, 3:41am UTC](https://meta.discourse.org/t/sso-and-embedding/128659 "2019-09-16T03:41:43Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![inflatablesnake](https://avatars.discourse-cdn.com/v4/letter/i/ecd19e/32.png) [@inflatablesnake](https://meta.discourse.org/u/inflatablesnake)
#### Post date: [September 16, 2019, 6:03am UTC](https://meta.discourse.org/t/sso-and-embedding/128659/2 "2019-09-16T06:03:24Z")

</div>

Upon doing some further digging around, I wonder if a slightly less hacky solution would be to adapt the approach described by @simon in this post: [Automatically login via SSO - #4 by simon](https://meta.discourse.org/t/automatically-login-via-sso/126195/4)

1. Enable “sso allows all return paths” setting
2. Add a hidden iframe on my page, which loads `https://discourse.example.com/session/sso?return_path=path_to_mypage.html`
3. When the user is logged in (no interaction, since the user already logged in via SSO into the app in the parent page) and the iframe is redirected to `mypage.html`, it can communicate to the parent page via postMessage() that the user has been logged into Discourse, and trigger the script to embed the forum topic.

Still doesn’t seem like the ideal solution, since it will generate extra round-trips (the above process is only really necessary if the user is not already logged into Discourse).

It seems to me like the ideal solution would be if it was somehow possible to preserve the referer URL of the embedding page when it gets redirected through SSO.

Edit: I implemented the improved “hack” described above in this post, and at the very least I can say it works much better than the original hack that I described in the OP.

---

_[View the full topic](https://meta.discourse.org/t/sso-and-embedding/128659)._