SSO Callback closes connection (0 bytes sent by server); used logged out of impersonation previously

Product Support SSO

AI-generated summary

A user, simon.michalke, reports a persistent issue with Discourse SSO where a user cannot log in after logging out of impersonation, resulting in a connection being closed by the server with no error logs. The issue appears to affect multiple users and is not related to network or device. After enabling verbose logging, the only record shows the SSO process starting. RGJ suggests enabling verbose_discourse_connect_logging. JammyDodger checks if the issue persists, and simon.michalke confirms it does. The problem spreads to other users, prompting a question about contacting paid support. JammyDodger references a similar issue on the Discourse meta forum. simon.michalke identifies the root cause: Nextcloud SSO only supports GET requests, and the nginx proxy drops POST requests due to excessive groups in the request header. The workaround is to patch the plugin to exclude groups, and the team plans to switch to Keycloak for authentication.

1

(Note, this was also reported here: Connection lost during callback · Issue #28 · habi-dat/discoursesso · GitHub)

Hello,

we are having a very weird issue with our Discourse SSO. Ever since one user logged out of impersonation, he is unable to log back in. This is what happens now if he tries to log in: (the user was logged into Nextcloud previously).

grafik
grafik1676×195 52.5 KB

The Server just closes the connection. I am unable to find any error log. Not inside any of the nginx proxies, not inside Discourse, not inside Nextcloud.

Interestingly it has nothing to do with the network or device. It is just this user that fails to log in.

I also tried clearing out the SSO Data from Discourse, changed the Email Address to force creation of a new Discourse Account. The Problem still persists.

I suspect this is an issue with the Nextcloud plugin, however I don’t see any error messages by Discourse, which surprises me. (I cleared the log and tried again, no record appeared.)

2

Did you enable Admin - Settings - Login - verbose_discourse_connect_logging ?

3

I just did. The only record is:

Verbose SSO log: Started SSO process

add_groups: 
admin: 
moderator: 
avatar_force_update: 
avatar_url: 
bio: 
card_background_url: 
confirmed_2fa: 
email: 
external_id: 
groups: 
locale: 
locale_force_update: 
location: 
logout: 
name: 
no_2fa_methods: 
nonce: <removed>
profile_background_url: 
remove_groups: 
require_2fa: 
require_activation: 
return_sso_url: https://hub.diehumanisten.de/session/sso_login
suppress_welcome_message: 
title: 
username: 
website:
4

Is this issue still ongoing @simon.michalke?

5

yes, we just tested it again and it still persists.

6

Okay, now we have a REAL issue. The problem seems to be spreading to other user. And the second one is not an admin and can therefore not use the workaround.

If I want to contact (paid) support, who should I talk to in my case?

7

Was this the right answer to your issue in the end? :crossed_fingers:

8

Yes. Nextcloud SSO only supports GET and not POST-based login. Our nginx proxy silently dropped the request since we had too many groups filling up the request header.

Our current workaround is manually patching the Plugin to not include groups:
https://github.com/soudis/discoursesso/issues/28#issuecomment-1165819892

We will switch to keycloak for authentication soon.