was Moderators should not see emails in SSO section - #13 by techAPJ reverted? It seems moderators are able to see the payload (which contains the email) again.

Not sure, @techAPJ can you have a peek when you are back?

I am not able to repro this on latest Discourse version. [imagem] anon60302432: It seems moderators are able to see the payload (which contains the email) again. Note that moderators will see the SSO payload but that payload will not contain external_email.

Is it possible to restrict visibility of the entire SSO section for mods?

Just updated to beta 3 and ran a test. Account only had moderator, last payload included the email even with the “moderators can see emails” option disabled. email= external_id= name= nonce= username= I noticed you mentioned external_email but on our payload its “email”, not “external_email”, m…

To add on, I believe I used this post when creating our SSO process: Discourse SSO and API Helper for PHP . Uses “email” as one of the parameters, not “external_email” @techAPJ

[imagem] anon60302432: last payload included the email even with the “moderators can see emails” option disabled. Are you talking about the /admin/users/{id}/{username} page or somewhere else?

[imagem] anon60302432: I noticed you mentioned external_email but on our payload its “email”, not “external_email”, maybe that’s why? Is that something we need to fix on our end? No, when the SSO record is created the external_email is saved as per: app/models/discourse_single_sign_o…

Aha, I see that the payload is visible to moderators. I’ve hidden the SSO payload for moderators via: https://github.com/discourse/discourse/commit/901d6080df6a62c8fbb4da697a9150fdd93211da We’re also discussing if the payload should be behind a button click for Admins (like we do for emails). Tha…

Payload do SSO pode ser visto por moderadores novamente?

Suporte

techAPJ (Arpit Jalan) Janeiro 3, 2021, 12:36pm 3

Não consigo reproduzir isso na versão mais recente do Discourse.

Observe que os moderadores verão o payload do SSO, mas esse payload não conterá external_email.

Tópico		Respostas	Visualizações
User email is not hidden under Single Sign On area of admin page Bug	3	752	17 de Fevereiro de 2021
Moderators should not see emails in SSO section UX	11	1838	11 de Novembro de 2020
Can no longer view users emails as a moderator Support	5	1293	28 de Junho de 2018
DiscourseConnect Single Sign On email & last payload cached across users Bug	1	807	20 de Outubro de 2021
SSO is forcibly creating the user as an admin Bug	12	1397	16 de Setembro de 2021

Payload do SSO pode ser visto por moderadores novamente?

Tópicos relacionados