# SSO הפסיק לעבוד לאחר שדרוג ל-2.6.2 (מ-2.5.1)

**URL:** https://meta.discourse.org/t/sso-stopped-working-after-upgrade-to-2-6-2-from-2-5-1/180901
**Category:** Support
**Created:** [23 בפברואר,‏ 2021,‏ 6:16pm UTC](https://meta.discourse.org/t/sso-stopped-working-after-upgrade-to-2-6-2-from-2-5-1/180901 "2021-02-23T18:16:47Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![rysher](https://avatars.discourse-cdn.com/v4/letter/r/e19b73/32.png) [@rysher](https://meta.discourse.org/u/rysher)
#### Post date: [23 בפברואר,‏ 2021,‏ 6:16pm UTC](https://meta.discourse.org/t/sso-stopped-working-after-upgrade-to-2-6-2-from-2-5-1/180901/1 "2021-02-23T18:16:47Z")

</div>

On trying to login, it always returns:

“Login Error  
Account login timed out, please try logging in again.”  
on [https://domain/session/sso\_login?sso=bm9...&sig=e4f7](https://domain/session/sso_login?sso=bm9...&sig=e4f7)…

and the Verbose SSO log has “Nonce has already expired”, I don’t see any other error messages.

It doesn’t work on both prod and dev environment, so I don’t think that it is related to the server configuration, nothing was changed in SSO code too.

I need some direction on where to dig in further, did something change in SSO or were any new configuration options added between 2.5.1 and 2.6.2?

---

<div class="post-metadata">

### Author: ![rysher](https://avatars.discourse-cdn.com/v4/letter/r/e19b73/32.png) [@rysher](https://meta.discourse.org/u/rysher)
#### Post date: [23 בפברואר,‏ 2021,‏ 7:06pm UTC](https://meta.discourse.org/t/sso-stopped-working-after-upgrade-to-2-6-2-from-2-5-1/180901/2 "2021-02-23T19:06:14Z")

</div>

Can it be the result of the recent:  
Attach [DiscourseConnect](https://meta.discourse.org/t/13045?silent=true) (SSO) nonce to current session

> <https://github.com/discourse/discourse/commit/5489a1c4d9ee63612cefd1224da6fb29dc88bbff>

?

---

<div class="post-metadata">

### Author: ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david)
#### Post date: [23 בפברואר,‏ 2021,‏ 7:09pm UTC](https://meta.discourse.org/t/sso-stopped-working-after-upgrade-to-2-6-2-from-2-5-1/180901/3 "2021-02-23T19:09:59Z")

</div>

Are you able to share a link to your site? Do you have any unusual setup with an app, or are users simply using a browser?

---

<div class="post-metadata">

### Author: ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david)
#### Post date: [23 בפברואר,‏ 2021,‏ 8:44pm UTC](https://meta.discourse.org/t/sso-stopped-working-after-upgrade-to-2-6-2-from-2-5-1/180901/4 "2021-02-23T20:44:45Z")

</div>

Thanks for the details via PM @rysher. In case it helps anyone else, the problem here was that the [DiscourseConnect](https://meta.discourse.org/t/13045?silent=true) flow is being initiated by a server-side request from the identity provider. This isn’t how the protocol is designed to be used, although before the recent security commit, it was technically possible.

The solution is to make sure that the users are directed to `/session/sso` in their own browser, before being redirected to the identity provider.

---

<div class="post-metadata">

### Author: ![system](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/system/32/443519_2.png) [@system](https://meta.discourse.org/u/system)
#### Post date: [25 במרץ,‏ 2021,‏ 8:45pm UTC](https://meta.discourse.org/t/sso-stopped-working-after-upgrade-to-2-6-2-from-2-5-1/180901/5 "2021-03-25T20:45:16Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.