SSO Authentication Issue with differently cased emails

Martin_Cash · August 1, 2017, 11:08pm

Today, I had a case of a member that would be redirected to the “confirm your email address” page every time they signed in to Discourse. They are able to sign in to other assets that use our authentication method just fine.

After some digging, we found that the email address stored in Discourse and on our authentication server had capital letters which they don’t actually type when signing in to anything. I had the member change their ID to lowercase and now they can sign in to Discourse without a problem.

I asked my authentication dude if I should send a ticket to him and he recommended i notify you guys as this “seems like a Discourse issue.”

codinghorror · August 1, 2017, 11:54pm

Hmm did we regress here @LeoMcA ? Make sure your code is case independent for many-to-one emails to users.

tgxworld · August 2, 2017, 2:07am

@LeoMcA added an unique index so we’re safe on this front.

github.com

discourse/discourse/blob/3538b63305582d53dabd1476170d99387fc4e97c/db/migrate/20170717084947_create_user_emails.rb#L15


      
          create_table :user_emails do |t|
            t.integer :user_id, null: false
            t.string :email, limit: 513, null: false
            t.boolean :primary, default: false, null: false
            t.timestamps
          end
          
          add_index :user_emails, :user_id
          add_index :user_emails, [:user_id, :primary], unique: true
          
          execute "CREATE UNIQUE INDEX index_user_emails_on_email ON user_emails (lower(email));"
          
          execute <<~SQL
          INSERT INTO user_emails (
            id,
            user_id,
            email,
            "primary",
            created_at,
            updated_at
          ) SELECT

tgxworld · August 10, 2017, 3:06am

@Martin_Cash There were some regressions we introduced when introducing multiple email address per user support. Usually all emails are downcased before being saved into the database but our code was incorrectly skipping validations. This should be resolved in

https://github.com/discourse/discourse/commit/0bc690ed11182448e33e910f1a697dfbcace63b4

but do let me know if you run into this again.

Topic		Replies	Views
Community login issue Support	4	734	November 10, 2017
How to handle Discourse SSO when the authentication site allows users to change emails? SSO	4	1270	February 24, 2023
On email address change second confirm fails due to email customization Support	20	1784	December 26, 2019
SSO with non-unique email addresses? Support	8	2055	June 8, 2024
Discourse sends the activation email to an old email address Support	3	422	March 3, 2021

SSO Authentication Issue with differently cased emails

Related Topics