ohm-s
September 13, 2021, 12:29pm
1
Hello
I am integrating discourse SSO , however I am facing a problem where the user being created is getting admin privileges even though that the SSO payload explicitly states that he shouldn’t be.
I am on the latest beta: 2.8.0.beta6 [ f3273bd43e ]
SSO URL:
https://community.bloom.pm/session/sso_login?sso=ZXh0ZXJuYWxfaWQ9NjEzZjJmMzMzNWZkODc4NWU4Mjk4Y2JhJm5vbmNlPThiNzdjM2JlMDBmMThkMjYwMDhkYjkxOWQxODA4MzAyJmVtYWlsPW9tYXIlMkJtZW1iZXI0JTQwYmxvb20ucG0mdXNlcm5hbWU9bWVtYmVyNCZuYW1lPW1lbWJlcjQmYWRtaW49ZmFsc2UmbW9kZXJhdG9yPWZhbHNlJnN1cHByZXNzX3dlbGNvbWVfbWVzc2FnZT10cnVl&sig=fcb3e5d3d4b8c39078753cb495f4c3781dcca1f022851a2bdff2015e7fa489b1
Decoding the sso payload gives:
external_id=613f2f3335fd8785e8298cba&nonce=8b77c3be00f18d26008db919d1808302&email=omar%2Bmember4%40bloom.pm&username=member4&name=member4&admin=false&moderator=false&suppress_welcome_message=true
However member4 was created with admin privileges
IAmGav
September 13, 2021, 12:33pm
2
is member4’s email address in the config file under developer ?
DISCOURSE_DEVELOPER_EMAILS
any email address listed there, will automatically become admin
1 Like
ohm-s
September 13, 2021, 1:08pm
3
I justed with omar+member9@306.dev which is a totally different domain and not on DISCOURSE_DEVELOPER_EMAILS but the issue is still there, the user got admin access
The api key I am using to sign the SSO belongs to admin, does that affect anything ?
michaeld
September 13, 2021, 8:30pm
4
That does not sound right? Can you explain what you are doing?
1 Like
ohm-s
September 14, 2021, 9:07am
5
I just integrated SSO on an existing discourse site and I am getting this behavior.
I logged in to the container and access the postgres db, the user has admin flag as false in the db so it is not being updated by the “make_developer_admin” method
What else could be there ?
ohm-s
September 14, 2021, 9:11am
6
I am also using those plugins
- git clone https:// github.com/discourse/docker_manager.git
- git clone https:// github.com/angusmcleod/discourse-events.git
- git clone https:// github.com/gdpelican/babble.git
- git clone https:// github.com/davidtaylorhq/discourse-whos-online.git
- git clone https:// github.com/discourse/discourse-checklist.git
- git clone https:// github.com/discourse/discourse-data-explorer.git
- git clone https:// github.com/BeXcellent/discourse-allowiframe.git
IAmGav
September 14, 2021, 9:35am
7
you might want to enable debugging to troubleshoot
To assist in debugging DiscourseConnect you may enable the site setting verbose_discourse_connect_logging . By enabling that site setting rich diagnostics will show up in YOURSITE.com/logs . Be sure to warnings box at the bottom of YOURSITE.com/logs .
reference: DiscourseConnect - Official Single-Sign-On for Discourse (sso)
ohm-s
September 14, 2021, 11:28am
8
The user is not admin, however there is a deeper issue, i added some logs
it looks like some kind of filtering bug using ActiveRecord api, i logged the queries and I don’t see userid in the where filter so it looks it is pulling the notifications data globally
How can i fix this ?
ohm-s
September 14, 2021, 11:28am
9
Posting 2nd media item (since i am new )
ohm-s
September 14, 2021, 11:29am
10
Posting 3rd media item - logs
ohm-s
September 14, 2021, 12:20pm
11
It looks like user.notifications is not adding the filter , i have manually added a where condition in the code and it got fixed in the modal notifications display, but in the details page, it uses a different code path so it is still displaying everything. What’s the real solution ?
ohm-s
September 14, 2021, 12:31pm
12
rails version: 6.1.4.1
bundle exec gem list --local
*** LOCAL GEMS ***
actionmailer (6.1.4.1)
ohm-s
September 16, 2021, 11:11am
13
I started a new docker container from scratch and moved the assets/data, that fixed the issue
#closed
1 Like
the 
