# Implementação de provedor SSO: admin, moderador e grupos ignorados?

**URL:** https://meta.discourse.org/t/sso-provider-implementation-admin-moderator-and-groups-ignored/113122
**Category:** Support
**Created:** [Abril 1, 2019, 1:44pm UTC](https://meta.discourse.org/t/sso-provider-implementation-admin-moderator-and-groups-ignored/113122 "2019-04-01T13:44:43Z")
**Posts on this page:** 13
**Page:** 1

<div class="post-metadata">

### Author: ![consideRatio](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/consideratio/32/126623_2.png) [@consideRatio](https://meta.discourse.org/u/consideRatio)
#### Post date: [Abril 1, 2019, 1:44pm UTC](https://meta.discourse.org/t/sso-provider-implementation-admin-moderator-and-groups-ignored/113122/1 "2019-04-01T13:44:44Z")

</div>

I have a problem very similar to [Avatars not pulling from SSO](https://meta.discourse.org/t/avatars-not-pulling-from-sso/105878). While users can login with my SSO provider ([consideratio/discourse-sso-oidc-bridge](https://github.com/consideratio/discourse-sso-oidc-bridge)), and discourse show up information in logs about it, the provided information about the signed in user being admin or not etc is ignored.

In other words, my SSO provider returns `admin: true` for example, but it does not affect the user that remains non-admin.

![image](https://global.discourse-cdn.com/meta/optimized/3X/7/1/710fbcd3aa18171d1eb2135fa8826af67c7dc116_2_690x36.png)

Ideas on what can be wrong or how to debug this further? I’m using [v2.3.0.beta5 +169](https://github.com/discourse/discourse/compare/da187f096734f8cf1716cbc89a8a6dd7b48cea41...tests-passed).

---

<div class="post-metadata">

### Author: ![consideRatio](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/consideratio/32/126623_2.png) [@consideRatio](https://meta.discourse.org/u/consideRatio)
#### Post date: [Abril 2, 2019, 12:53pm UTC](https://meta.discourse.org/t/sso-provider-implementation-admin-moderator-and-groups-ignored/113122/3 "2019-04-02T12:53:59Z")

</div>

# Suspicion 1

Discourse manages to say “User was logged on” and list “admin: true”. Am I correct to assume that when this happens, the user is meant to become an admin if the user wasn’t already? Or, does it require additional steps?

I saw the following from [Setup DiscourseConnect - Official Single-Sign-On for Discourse (sso)](https://meta.discourse.org/t/official-single-sign-on-for-discourse-sso/13045), but I’m thinking this is mostly if you want to sync without having a user login at all, but you can also sync while the user is logging in. Or? Hmmm…

 ![image](https://global.discourse-cdn.com/meta/original/3X/9/f/9fdcd43d6f6bb6cb132d1ea411923ccd4e745cbe.png)

---

<div class="post-metadata">

### Author: ![consideRatio](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/consideratio/32/126623_2.png) [@consideRatio](https://meta.discourse.org/u/consideRatio)
#### Post date: [Abril 2, 2019, 1:07pm UTC](https://meta.discourse.org/t/sso-provider-implementation-admin-moderator-and-groups-ignored/113122/4 "2019-04-02T13:07:14Z")

</div>

# Suspicion 2

When I inspected the logs further, I found that params listed does not contain the full sso param, but only a truncated part. What is going on here? The only information within the sso params that is truncated is `nonce=01bcdfd0a32b809567991b3dbd59fe9f&return_sso_url=https%3A%2F%2Fdiscour`, but discourse has parsed more information at some point so I assume this is a artifact of the logger.

```plaintext
### Env

hostname <redacted>
process_id 17301
application_version da187f096734f8cf1716cbc89a8a6dd7b48cea41
HTTP_HOST <redacted>
REQUEST_URI /session/sso_login?sso=bm9uY2U9MDFiY2RmZDBhMzJiODA5NTY3OTkxYjNkYmQ1OWZlOWYmcmV0dXJuX3Nzb191cmw9aHR0cHMlM0ElMkYlMkZkaXNjb3Vyc2UuZHNwLnNhbmR2aWsuY29tJTJGc2Vzc2lvbiUyRnNzb19sb2dpbiZhZG1pbj10cnVlJm1vZGVyYXRvcj10cnVlJmVtYWlsPWVyaWsuc3VuZGVsbCU0MHNhbmR2aWsuY29tJmxvY2FsZT1lbi1VUyZuYW1lPUVyaWslMjBTdW5kZWxsJnVzZXJuYW1lPWVyaWsuc3VuZGVsbCU0MHNhbmR2aWsuY29tJmV4dGVybmFsX2lkPTAwdTdzeG5nbXh0bkVmalE4MzU2&amp;sig=069549ea561b3e68e583866a05d5d84a2df291c7219295fe4236c4c467b449d5
REQUEST_METHOD GET
HTTP_USER_AGENT Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36
HTTP_ACCEPT text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
HTTP_X_FORWARDED_FOR <redacted>, <redacted>
HTTP_X_REAL_IP <redacted>
params:
  sso bm9uY2U9MDFiY2RmZDBhMzJiODA5NTY3OTkxYjNkYmQ1OWZlOWYmcmV0dXJuX3Nzb191cmw9aHR0cHMlM0ElMkYlMkZkaXNjb3Vyc
  sig 069549ea561b3e68e583866a05d5d84a2df291c7219295fe4236c4c467b449d5

```

---

<div class="post-metadata">

### Author: ![consideRatio](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/consideratio/32/126623_2.png) [@consideRatio](https://meta.discourse.org/u/consideRatio)
#### Post date: [Abril 2, 2019, 1:21pm UTC](https://meta.discourse.org/t/sso-provider-implementation-admin-moderator-and-groups-ignored/113122/5 "2019-04-02T13:21:44Z")

</div>

# Code inspection

I tried to figure something out, but I failed…

### Starting point - Discourse gets user information from my SSO provider

I found my way here by spotting the “User was logged on” text from /logs in Discourse.

> <https://github.com/discourse/discourse/blob/fdf4145d4b09fa1dab651c554d201f05f1f87fb8/app/controllers/session_controller.rb#L109>

### In the sso\_login, a DiscourseSingleSignOn instance named sso is created

> <https://github.com/discourse/discourse/blob/fdf4145d4b09fa1dab651c554d201f05f1f87fb8/app/controllers/session_controller.rb#L116>

### sso.lookup\_or\_create\_user is called

> <https://github.com/discourse/discourse/blob/f8be43644b72bd36dd499c4c477cd440ceb0249f/app/models/discourse_single_sign_on.rb#L49>

### The admin stuff is set

> <https://github.com/discourse/discourse/blob/f8be43644b72bd36dd499c4c477cd440ceb0249f/app/models/discourse_single_sign_on.rb#L78-L85>

---

<div class="post-metadata">

### Author: ![simon](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/simon/32/339122_2.png) [@simon](https://meta.discourse.org/u/simon)
#### Post date: [Abril 4, 2019, 12:54am UTC](https://meta.discourse.org/t/sso-provider-implementation-admin-moderator-and-groups-ignored/113122/6 "2019-04-04T00:54:41Z")

</div>

> [@consideRatio](#):
>
> Discourse manages to say “User was logged on” and list “admin: true”. Am I correct to assume that when this happens, the user is meant to become an admin if the user wasn’t already?

Yes, setting the SSO parameter `admin` to `true` should be all that’s required to log a user in as an admin. When I test this on my own site it works for me. From the screenshot in your initial post, it looks like the parameter is set correctly. Are you still having trouble getting this to work?

---

<div class="post-metadata">

### Author: ![consideRatio](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/consideratio/32/126623_2.png) [@consideRatio](https://meta.discourse.org/u/consideRatio)
#### Post date: [Abril 4, 2019, 12:57am UTC](https://meta.discourse.org/t/sso-provider-implementation-admin-moderator-and-groups-ignored/113122/7 "2019-04-04T00:57:43Z")

</div>

Ah thanks for confirming that @simon! Yepp the issue persist and I have failed to find another clue on what may be wrong. =/

---

<div class="post-metadata">

### Author: ![simon](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/simon/32/339122_2.png) [@simon](https://meta.discourse.org/u/simon)
#### Post date: [Abril 4, 2019, 1:00am UTC](https://meta.discourse.org/t/sso-provider-implementation-admin-moderator-and-groups-ignored/113122/8 "2019-04-04T01:00:02Z")

</div>

Is this for a forum that we are hosting, or is it a self-hosted site?

---

<div class="post-metadata">

### Author: ![consideRatio](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/consideratio/32/126623_2.png) [@consideRatio](https://meta.discourse.org/u/consideRatio)
#### Post date: [Abril 4, 2019, 1:37am UTC](https://meta.discourse.org/t/sso-provider-implementation-admin-moderator-and-groups-ignored/113122/9 "2019-04-04T01:37:00Z")

</div>

This forum is a self hosted site, using a SSO provider I’ve written myself based on previous work of others ([GitHub - consideRatio/discourse-sso-oidc-bridge: Discourse SSO OIDC Bridge - A Python PyPI package · GitHub](http://github.com/consideratio/discourse-sso-oidc-bridge)).

---

<div class="post-metadata">

### Author: ![Falco](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/falco/32/179432_2.png) [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [Abril 4, 2019, 3:01am UTC](https://meta.discourse.org/t/sso-provider-implementation-admin-moderator-and-groups-ignored/113122/10 "2019-04-04T03:01:22Z")

</div>

Enable verbose SSO logs, logout, log in with a user that sends the admin flag in the payload, check logs.

---

<div class="post-metadata">

### Author: ![consideRatio](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/consideratio/32/126623_2.png) [@consideRatio](https://meta.discourse.org/u/consideRatio)
#### Post date: [Abril 4, 2019, 8:10am UTC](https://meta.discourse.org/t/sso-provider-implementation-admin-moderator-and-groups-ignored/113122/11 "2019-04-04T08:10:15Z")

</div>

@falco thanks, it does only contain the kind of warning log entry about a sso request starting and another log entry indicating a successful login.

---

<div class="post-metadata">

### Author: ![Falco](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/falco/32/179432_2.png) [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [Abril 4, 2019, 3:05pm UTC](https://meta.discourse.org/t/sso-provider-implementation-admin-moderator-and-groups-ignored/113122/12 "2019-04-04T15:05:44Z")

</div>

No, it doesn’t.

Click on the entry, then on the tabs below, and it will have every key in the payload and the respective value in a table format.

---

<div class="post-metadata">

### Author: ![consideRatio](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/consideratio/32/126623_2.png) [@consideRatio](https://meta.discourse.org/u/consideRatio)
#### Post date: [Abril 15, 2019, 11:42am UTC](https://meta.discourse.org/t/sso-provider-implementation-admin-moderator-and-groups-ignored/113122/13 "2019-04-15T11:42:25Z")

</div>

I had multiple issues, resolving them did the trick for me.

1. My group names needed to meet certain cirteria:

2. I did not understand that I needed to create the groups in advance. I thought that they would be created if they did not exist.

3. I needed to avoid caching in the sso-provider and ensure I get a refreshed list of groups etc.

---

<div class="post-metadata">

### Author: ![system](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/system/32/443519_2.png) [@system](https://meta.discourse.org/u/system)
#### Post date: [Maio 15, 2019, 11:55am UTC](https://meta.discourse.org/t/sso-provider-implementation-admin-moderator-and-groups-ignored/113122/14 "2019-05-15T11:55:55Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.