# Supporting multiple SSO secrets with Discourse as provider

**URL:** <https://meta.discourse.org/t/supporting-multiple-sso-secrets-with-discourse-as-provider/96693>\
**Category:** Feature\
**Tags:** sso, discourseconnect\
**Created:** [September 8, 2018, 1:27am UTC](https://meta.discourse.org/t/supporting-multiple-sso-secrets-with-discourse-as-provider/96693 "2018-09-08T01:27:44Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![supermathie](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/supermathie/32/507518_2.png) [@supermathie](https://meta.discourse.org/u/supermathie)\
**Post date:** [September 8, 2018, 1:27am UTC](https://meta.discourse.org/t/supporting-multiple-sso-secrets-with-discourse-as-provider/96693/1 "2018-09-08T01:27:44Z")

</div>

It would be nice to allow the [Discourse SSO](https://meta.discourse.org/t/13045?silent=true) provider to allow multiple secrets.

Use cases (yeah, I know the first two are kind of the same):

- allow use of a testing setup of an [auth-proxy](https://github.com/discourse/discourse-auth-proxy) against a production Discourse install without risking the exposure of the production secret
- allow the authentication of a service managed by an external entity without leaking the production secret
- allow the [Discourse SSO](https://meta.discourse.org/t/13045?silent=true) _Consumer_ secret to differ from the _Provider_ secret (would anyone do both at once?)

Two options immediately come to mind:

- have Discourse sign the SSO payload both with key `k` and `hash(k+consumer.hostname)`
  - backwards compatible, allows a SSO consumer that expects such a thing to check both signatures
  - presumably does not leak key `k` to the consumer since the consumer need only know `hash(k+consumer.hostname)`
  - probably easy to implement

- build into Discourse explicit support for differing keys `k1`, `k2`, etc. per (set/glob of hostnames)
  - would be easier for multiple services all using a single key
  - more work to implement
  - probably the “better” way to do it 😃

---

_[View the full topic](https://meta.discourse.org/t/supporting-multiple-sso-secrets-with-discourse-as-provider/96693)._