was Moderators should not see emails in SSO section - #13 by techAPJ reverted? It seems moderators are able to see the payload (which contains the email) again.

Not sure, @techAPJ can you have a peek when you are back?

I am not able to repro this on latest Discourse version. [imagen] anon60302432: It seems moderators are able to see the payload (which contains the email) again. Note that moderators will see the SSO payload but that payload will not contain external_email.

Is it possible to restrict visibility of the entire SSO section for mods?

Just updated to beta 3 and ran a test. Account only had moderator, last payload included the email even with the “moderators can see emails” option disabled. email= external_id= name= nonce= username= I noticed you mentioned external_email but on our payload its “email”, not “external_email”, m…

To add on, I believe I used this post when creating our SSO process: Discourse SSO and API Helper for PHP . Uses “email” as one of the parameters, not “external_email” @techAPJ

[imagen] anon60302432: last payload included the email even with the “moderators can see emails” option disabled. Are you talking about the /admin/users/{id}/{username} page or somewhere else?

[imagen] anon60302432: I noticed you mentioned external_email but on our payload its “email”, not “external_email”, maybe that’s why? Is that something we need to fix on our end? No, when the SSO record is created the external_email is saved as per: app/models/discourse_single_sign_o…

Aha, I see that the payload is visible to moderators. I’ve hidden the SSO payload for moderators via: https://github.com/discourse/discourse/commit/901d6080df6a62c8fbb4da697a9150fdd93211da We’re also discussing if the payload should be behind a button click for Admins (like we do for emails). Tha…

¿El payload de SSO puede ser visto nuevamente por los moderadores?

Soporte

techAPJ (Arpit Jalan) 3 Enero, 2021 12:36 3

No puedo reproducir esto en la última versión de Discourse.

Ten en cuenta que los moderadores verán el payload de SSO, pero ese payload no contendrá external_email.

Tema		Respuestas	Vistas
User email is not hidden under Single Sign On area of admin page Bug	3	752	17 Febrero 2021
Moderators should not see emails in SSO section UX	11	1838	11 Noviembre 2020
Can no longer view users emails as a moderator Support	5	1292	28 Junio 2018
DiscourseConnect Single Sign On email & last payload cached across users Bug	1	807	20 Octubre 2021
SSO is forcibly creating the user as an admin Bug	12	1397	16 Septiembre 2021

¿El payload de SSO puede ser visto nuevamente por los moderadores?

Temas relacionados