User Nitin_Digraje reports an issue with Discourse SSO integration in a Laravel/PHP platform: custom profile pictures update only on the first SSO login, not on subsequent updates—even when avatar_force_update=true is passed and the user logs out/in or reloads the browser. The SSO record shows the updated avatar URL, but the image doesn’t reflect in Discourse. pfaffman suggests reloading the browser or enabling verbose logging to inspect SSO data. renato asks if the discourse_connect_overrides_avatar site setting is enabled; Nitin_Digraje confirms it’s not. simon advises enabling discourse_connect_overrides_avatar and re-logging in, noting that avatar_force_update=true should work without it—but warns that some frameworks (like WordPress) may send 0/1 instead of true, which Discourse accepts as the string 'true'. Verifying the SSO payload value via admin logs or verbose logging is recommended to debug the issue.
We are integrating discourse with Php/Laravel platform where we have implemented SSO. Users custom picture getting updated only once. However if i change profile picture in laravel platform, custom picture not updated in discourse again even after i logout and login again.
Even though i have passed ‘avatar_force_update’ as true, avatar custom picture is not getting overriden.
Just to update
I can see profile picture url updated SSO record, however new profile image is not reflected in discourse even after i logout and login again.
What if you reload your browser?
Do you have the discourse_connect_overrides_avatar site setting enabled?
Thank you for reply. If I reload browser or open in incognito or even logout and login again, it doesnt get updated.
As mentioned, it gets updated only first time. For example
You can try turning on verbose logging and looking at the logs to see if the SSO system is sending over the avatar info.
It might be worth enabling the discourse connect overrides avatar setting, logging out of Discourse, then logging back in again. I’m fairly sure it’s expected that the avatar can be updated without that setting enabled as long as the avatar_force_update parameter is set to true in the SSO payload. The code that handles this is kind of complex though: discourse/app/models/discourse_connect.rb at 2ff3f44b957268718e03554fb25d485e1d449ed5 · discourse/discourse · GitHub.
If you can’t enable that setting, or are just curious about what’s going on, another thing to check is to make sure that the value you’re passing for the avatar_force_update parameter is being interpreted as the boolean true by Discourse. There are frameworks (notably WordPress) where boolean values get converted to 0 or 1. To work around that issue, Discourse will accept the string "true" as a boolean value in the SSO payload. You can probably confirm this by looking at the value of the avatar_force_update field in the SSO record that’s displayed on the user’s admin page. Or by enabling the verbose logging setting that Jay mentioned.
