SSO payload can be seen be moderators again?

support
#1

was Moderators should not see emails in SSO section - #13 by techAPJ reverted? It seems moderators are able to see the payload (which contains the email) again.

#2

Not sure, @techAPJ can you have a peek when you are back?

1 Like
#3

I am not able to repro this on latest Discourse version.

Note that moderators will see the SSO payload but that payload will not contain external_email.

3 Likes
#4

Is it possible to restrict visibility of the entire SSO section for mods?

#5

Just updated to beta 3 and ran a test. Account only had moderator, last payload included the email even with the “moderators can see emails” option disabled.

email=
external_id=
name= 
nonce= 
username=

I noticed you mentioned external_email but on our payload its “email”, not “external_email”, maybe that’s why? Is that something we need to fix on our end?

#6

To add on, I believe I used this post when creating our SSO process: Discourse SSO and API Helper for PHP. Uses “email” as one of the parameters, not “external_email”

@techAPJ

#7

Thoughts on the above? ^^

#8

Are you talking about the /admin/users/{id}/{username} page or somewhere else?

1 Like
#9

No, when the SSO record is created the external_email is saved as per:

In reference to:

email=
external_id=
name= 
nonce= 
username=

Where are you seeing this payload in Discourse? As you can see above the email is saved as external_email, name is saved as external_name, etc.

1 Like
#10

Yep, /admin/users/{id}/{username}

This screenshot was taken from one of our moderators

unknown-4
unknown-41191Ă—461 25.9 KB

1 Like
Geometric, a dark theme for Discourse
User email is not hidden under Single Sign On area of admin page
#11

Aha, I see that the payload is visible to moderators. I’ve hidden the SSO payload for moderators via:

We’re also discussing if the payload should be behind a button click for Admins (like we do for emails).

Thanks for the excellent report @Callahan, and for persistent follow-up. :trophy:

3 Likes