# SSO avatar not updating when using URLs from my site

**URL:** https://meta.discourse.org/t/sso-avatar-not-updating-when-using-urls-from-my-site/99603
**Category:** SSO
**Created:** [October 16, 2018, 4:15am UTC](https://meta.discourse.org/t/sso-avatar-not-updating-when-using-urls-from-my-site/99603 "2018-10-16T04:15:34Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![twm](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/twm/32/141663_2.png) [@twm](https://meta.discourse.org/u/twm)
#### Post date: [October 16, 2018, 4:15am UTC](https://meta.discourse.org/t/sso-avatar-not-updating-when-using-urls-from-my-site/99603/1 "2018-10-16T04:15:34Z")

</div>

Hello, I hope someone can help me with this.

I’m using the WordPress discourse plugin with WordPress as my SSO provider. I’m trying to set the `avatar_ur`l from a custom user meta field populated with a gravity form.

When I view the logs I can see that the correct `avatar_url` is coming in with the payload.

 ![864da9758d](https://global.discourse-cdn.com/meta/original/3X/7/1/7137decc6e0c2f54280c61a9e2045abad83cae76.png)

Here is the function I’m using to insert the `avatar_url` into the SSO payload. I’ve also tried using the wpdc\_sso\_params filter with the same results.

```
add_filter( 'wpdc_sso_avatar_url', 'gn_use_custom_avatar', 10, 2 );
function gn_use_custom_avatar( $avatar_url, $user_id ) {
    if ( get_user_meta( $user_id, 'user_avatar', true ) ) {
        $avatar_url = get_user_meta( $user_id, 'user_avatar', true );
    }
    return $avatar_url;
}

```

Stranger still, if I set the `$avatar_ur`l to a random image hosted on another site I will see the avatar image update.

I’ve tried using the curl command from my discourse’s docker instance on the avatar URL in the user’s meta and I’m not getting any errors. So, I’m at a loss at how to proceed.

Any idea?

---

<div class="post-metadata">

### Author: ![omarfilip](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/omarfilip/32/208019_2.png) [@omarfilip](https://meta.discourse.org/u/omarfilip)
#### Post date: [October 16, 2018, 4:43am UTC](https://meta.discourse.org/t/sso-avatar-not-updating-when-using-urls-from-my-site/99603/2 "2018-10-16T04:43:35Z")

</div>

Does the WP site have an SSL certificate? (http vs https in the avatar\_url)

Is Discourse forcing https? `Settings > Security > force https`

---

<div class="post-metadata">

### Author: ![twm](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/twm/32/141663_2.png) [@twm](https://meta.discourse.org/u/twm)
#### Post date: [October 16, 2018, 2:45pm UTC](https://meta.discourse.org/t/sso-avatar-not-updating-when-using-urls-from-my-site/99603/3 "2018-10-16T14:45:57Z")

</div>

No SSL certificate on the wordpress site and discourse isn’t forcing https. I’ve tested passing https vs http images hosted on other sites and they always work.

---

<div class="post-metadata">

### Author: ![ssvenn](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/ssvenn/32/86740_2.png) [@ssvenn](https://meta.discourse.org/u/ssvenn)
#### Post date: [October 16, 2018, 6:30pm UTC](https://meta.discourse.org/t/sso-avatar-not-updating-when-using-urls-from-my-site/99603/4 "2018-10-16T18:30:27Z")

</div>

Try pinging the wordpress server from inside the discourse server and see what kind of IP it resolves to.

Discourse has protections against getting abused as a bridge from a public network to internal networks, so if your wordpress SSO is running on a [Private network - Wikipedia](https://en.wikipedia.org/wiki/Private_network#Private_IPv4_addresses) you will need to add the server to a whitelist, see [Allow list of internal hosts for scanning](https://meta.discourse.org/t/whitelisting-internal-hosts-for-crawling/64442)