The discussion revolves around SSO integration and external profile syncing with Discourse. Brock_Busby seeks guidance on syncing updates from an external profile to Discourse, backend syncing, and auto-logout timing.
Brock_Busby is advised by DeanMarkTaylor to refer to the “Synchronizing SSO records” section in the official Discourse SSO documentation. For backend syncing, DeanMarkTaylor suggests server-side syncing using a single HTTP request, eliminating the need for client-side messages.
Regarding auto-logout, DeanMarkTaylor recommends avoiding excessive inactive time without re-authentication, ideally within 60 days. To prevent auto-logout, DeanMarkTaylor proposes inserting a hidden IFRAME of the Discourse site’s /session/sso URL, keeping the session alive when users interact with the external site.
simon corrects DeanMarkTaylor, stating that the Discourse WordPress plugin uses the sync_sso route for syncing SSO records, rather than a hidden IFRAME.
Hi Community - we have a successful SSO integration currently. When users are created on our site, it creates the user on Discourse, but we need some direction on the following:
We noticed the options for SSO payload updating bio, email, avatar, etc. and it will be refreshed on login. Users will be able to update these settings on their external profile. How do we sync these updates when they save on their external profile?
Is there a way to have these syncs happen in the backend? When a user logs in, and while the sync happens, we display a message to the user. This can be problematic since it can take longer than we’d like and gives opportunity to interrupt the sync with a refresh or closing the tab.
Discourse auto log out: by default, Discourse logs users out after 1440 hours. We do not auto log out our users on our external site and must manually log out. Anyone have any advice or warnings here? e.g. the user deletes their cookies/sessions will that be an issue?
Just get your auth / profile editing external site to sync to Discourse server-side as soon as a change occurs, it’s a single HTTP request. No need for messages etc. You should not be doing this client-side - i.e. no worries about closing a tab.
For security reasons I would avoid going beyond 60 days without requiring re-auth if the user hasn’t interacted with Discourse.
3.
If users do use your external site just have your page contain insert a hidden IFRAME / EMBED of the Discourse site to the URL /session/sso…
Only add this hidden IFRAME when the user hasn’t been authenticated recently (so it doesn’t slow down every page load) - probably just when they initially login.
This will keep the Discourse session alive. (EDIT: Note this will also log them into Discourse if they aren’t already)
You can look to the Discourse WordPress plugin I believe it contains something like this.
The WordPress plugin doesn’t add a hidden iframe. It does have an option to sync SSO records without users logging in, but it uses the sync_sso route for that.