# Use Discourse SSO with Mediawiki
**URL:** https://meta.discourse.org/t/use-discourse-sso-with-mediawiki/69218
**Category:** Administrators
**Tags:** sso, how-to
**Created:** [9월 1, 2017, 4:57오후 UTC](https://meta.discourse.org/t/use-discourse-sso-with-mediawiki/69218 "2017-09-01T16:57:44Z")
**Posts on this page:** 17
**Page:** 1
### Author:  [@SXX](https://meta.discourse.org/u/SXX)
#### Post date: [9월 1, 2017, 4:57오후 UTC](https://meta.discourse.org/t/use-discourse-sso-with-mediawiki/69218/1 "2017-09-01T16:57:44Z")
While trying to find ready-to-use solution I’ve seen multiple questions on Internet about that and at least one topic on this forum. I also need to integrate [Discourse SSO](https://meta.discourse.org/t/13045?silent=true) with Mantis Bug Tracker so I decide to go with more generic code that I might reuse for Mantis as well. Code is very ugly, but it’s works and might help someone.
### Read the instruction and activate SSO provider in Discourse
> [@Use Discourse as an identity provider (SSO, DiscourseConnect)](https://meta.discourse.org/t/using-discourse-as-a-sso-provider/32974):
>
> So you want to use Discourse as an identity provider for your own web app? Great! Let’s get started. Enable [DiscourseConnect](https://meta.discourse.org/t/13045?silent=true) provider setting Under Discourse admin site settings (/admin/site\_settings) enable setting enable discourse connect provider and add a secret string to discourse connect provider secrets (used to hash SSO payloads). Implement [DiscourseConnect](https://meta.discourse.org/t/13045?silent=true) in your web app: Generate a random [nonce](https://en.wikipedia.org/wiki/Cryptographic_nonce). Let’s call this value NONCE. Save it temporarily so that you can verify it with the …
### Install Auth\_remoteuser extension for MediaWiki
More information about extension:
> **[Extension:Auth remoteuser - MediaWiki](https://www.mediawiki.org/wiki/Extension:Auth_remoteuser)**
Make sure to check instructions so you can adjust it’s settings for your needs.
Mirror on GitHub:
[https://github.com/wikimedia/mediawiki-extensions-Auth\_remoteuser](https://github.com/wikimedia/mediawiki-extensions-Auth_remoteuser)
You can clone extension from github into your wiki directory:
```plaintext
git clone https://github.com/wikimedia/mediawiki-extensions-Auth_remoteuser.git /path/to/mediawiki/extensions/Auth_remoteuser
```
### Install [Discourse SSO](https://meta.discourse.org/t/13045?silent=true) client script
1. Get script from GitHub:
[GitHub - ArseniyShestakov/singlefile-discourse-sso-php: Ugly, but working single-file SSO implementation in PHP · GitHub](https://github.com/ArseniyShestakov/singlefile-discourse-sso-php)
2. Copy `discourse-sso.php` into directory with your wiki.
3. Edit defines on top of file according to your need.
4. To create database table and test it visit `https://your.wiki.domain/discourse-sso.php`
You can check databse table contents from command line:
```plaintext
mysql -u wikiuser -pPASSWORD wikidb -e "SELECT * FROM sso_login;"
```
If everything is fine you’ll see username / email and other information here.
### Edit LocalSettings.php
First of all make sure you set `createaccount` and `autocreateaccount` permissions properly:
```plaintext
// Forbid account creation by users
$wgGroupPermissions['*']['createaccount'] = false;
// Allow extensions to manage users
$wgGroupPermissions['*']['autocreateaccount'] = true;
```
After that you’ll need to add code like this to the end of wiki configuration file:
```plaintext
// Discourse authentification
require_once( "$IP/discourse-sso.php" );
$DISCOURSE_SSO = new DiscourseSSOClient();
$SSO_STATUS = $DISCOURSE_SSO->getAuthentication();
if(true === $SSO_STATUS['logged'] && !empty($SSO_STATUS['data']['username']))
{
$wgAuthRemoteuserUserName = $SSO_STATUS['data']['username'];
$wgAuthRemoteuserUserPrefs = [
'email' => $SSO_STATUS['data']['email']
];
// $wgAuthRemoteuserUserPrefsForced = [
// 'email' => $SSO_STATUS['data']['email']
// ];
if(!empty($SSO_STATUS['data']['name']))
{
$wgAuthRemoteuserUserPrefs['realname'] = $SSO_STATUS['data']['name'];
// $wgAuthRemoteuserUserPrefsForced['realname'] = $SSO_STATUS['data']['name'];
}
wfLoadExtension( 'Auth_remoteuser' );
}
```
If you uncomment lines with `force` email / name will be changed not just for newly automatically-created users, but also for existing wiki users.
### Test it
Now after you visit `https://your.wiki.domain/discourse-sso.php` you should be redirected to your wiki and you’ll be logged-in.
### Redirect Login URL to SSO script:
I not yet find best easy to change login url so I just used following redirect via nginx:
```plaintext
if ($request_uri ~* "^.*Special:UserLogin.*$") {
return 302 https://your.wiki.domain/discourse-sso.php;
}
```
### To be continued…
This is only tested on wiki of project I worked on and likely . **Use on your own risk!**
I’ll try to improve this guide as soon as I find better ways to integrate it into Mediawiki.
---
### Author:  [@bekircem](https://meta.discourse.org/u/bekircem)
#### Post date: [6월 24, 2018, 10:43오전 UTC](https://meta.discourse.org/t/use-discourse-sso-with-mediawiki/69218/2 "2018-06-24T10:43:28Z")
Hi, I set up SSO for Discourse and Medaiwiki. When i click log in button it gives me 404 error:
```
**https://site.com/discourse-sso.php?sso=bm9uY2U9ZmM0ODkzYzMwZjE2ZDM1YWJkMDljN2E4NzczYzJkYmI2Y2FhNGU0ZDA3NTg5YTk1NzhkNDIxZWZkOGMyN2Y0OGRiYWViMzA4ZTIzOTQ0MzVkZmYxZTk5NmZmMDAxMGYzMDEyYjk1ZTllZGE0M2E5NTE3NjFkMzdiOGFjMjNkNTQmbmFtZT1TU08mdXNlcm5hbWU9c3NvdGVzdHVzZXImZW1haWw9cG9zdGElNDBnYW1lb2Z0aHJvbmVzdHIuY29tJmV4dGVybmFsX2lkPTEwNDM2JnJldHVybl9zc29fdXJsPWh0dHBzJTNBJTJGJTJGdmlraS5nYW1lb2Z0aHJvbmVzdHIuY29tJTJGZGlzY291cnNlLXNzby5waHAmYWRtaW49ZmFsc2UmbW9kZXJhdG9yPWZhbHNlJmdyb3Vwcz10cnVzdF9sZXZlbF8w&sig=6f21b389bc5bbbf8420addbe9ceacb0dbe6e6d5643a8aab66f20de6058b9ecd4**
HTTP ERROR 404
```
Any idea?
Edit: I checked database tables. There is no sso\_login table in database. ☹ I fixed it but
```
mysql> SELECT * FROM sso_login;
Empty set (0.00 sec)
```
I fixed that too. But still doesn’t work. User’s can’t login wiki after login to Discourse.
---
### Author:  [@SXX](https://meta.discourse.org/u/SXX)
#### Post date: [6월 25, 2018, 10:22오전 UTC](https://meta.discourse.org/t/use-discourse-sso-with-mediawiki/69218/3 "2018-06-25T10:22:44Z")
> [@bekircem](#):
>
> Edit: I checked database tables. There is no sso\_login table in database. ☹ I fixed it but
How exactly you fixed it? Database table supposed to be created on you manually run script by visiting it first time browser.
> [@bekircem](#):
>
> I fixed that too. But still doesn’t work. User’s can’t login wiki after login to Discourse.
Can you clarify what exactly is wrong?
If it’s 404 then you need to make sure that `discourse-sso.php` file is located in right directory.
---
### Author:  [@bekircem](https://meta.discourse.org/u/bekircem)
#### Post date: [6월 25, 2018, 10:35오전 UTC](https://meta.discourse.org/t/use-discourse-sso-with-mediawiki/69218/4 "2018-06-25T10:35:52Z")
> [@SXX](#):
>
> How exactly you fixed it? Database table supposed to be created on you manually run script by visiting it first time browser.
First time, i set up wrong database informations. So database table can’t created. But i fixed. After that, i checked on terminal, table and user infromations created correctly.
> [@SXX](#):
>
> Can you clarify what exactly is wrong?
>
> If it’s 404 then you need to make sure that `discourse-sso.php` file is located in right directory
I tried to create new user and login, user informations created on sso\_login table but on the wiki not logged in. Discourse-sso.php file is located right directory and when i go [wiki.site.com/discourse-sso.php](http://wiki.site.com/discourse-sso.php) its directing to Discourse login page. But cannot loggin in Mediawiki.
---
### Author:  [@SXX](https://meta.discourse.org/u/SXX)
#### Post date: [6월 25, 2018, 10:58오전 UTC](https://meta.discourse.org/t/use-discourse-sso-with-mediawiki/69218/5 "2018-06-25T10:58:24Z")
Ok if database is fine then SSO itself is working.
What Mediawiki version are you using right now? I probably should try to upgrade my own instance to latest version and check if something will break.
If you have some understanding of PHP you can try debug it on your own:
- Make sure code for `Auth_remoteuser` is in the end of `LocalSettings.php`
- Try to add something like `var_dump($SSO_STATUS);exit;` and check what it’s going to print when you going to wiki.
- SSO code working fine and there is valid username then make sure `Auth_remoteuser` mediawiki extension is in proper directory and working fine.
Also feel free to can contact me via instant messenger if you need some assistance. You’ll find contacts via my profile.
---
### Author:  [@bekircem](https://meta.discourse.org/u/bekircem)
#### Post date: [6월 25, 2018, 11:25오전 UTC](https://meta.discourse.org/t/use-discourse-sso-with-mediawiki/69218/6 "2018-06-25T11:25:06Z")
> [@SXX](#):
>
> assistance.
I use Mediawiki 1.25. I tried updating in the past. I had trouble with Composer. But I will try again. Also i will try debug.
---
### Author:  [@SXX](https://meta.discourse.org/u/SXX)
#### Post date: [6월 25, 2018, 11:30오전 UTC](https://meta.discourse.org/t/use-discourse-sso-with-mediawiki/69218/7 "2018-06-25T11:30:38Z")
> [@bekircem](#):
>
> I use Mediawiki 1.25. I tried updating in the past. I had trouble with Composer. But I will try again. Also i will try debug.
Most likely old Mediawiki is the reason why it doesn’t work: `Auth_remoteuser` require 1.27+
> **[Extension:Auth remoteuser - MediaWiki](https://www.mediawiki.org/wiki/Extension:Auth_remoteuser)**
I updated our wiki a year ago and it’s using 1.28.2.
---
### Author:  [@bekircem](https://meta.discourse.org/u/bekircem)
#### Post date: [6월 25, 2018, 11:32오전 UTC](https://meta.discourse.org/t/use-discourse-sso-with-mediawiki/69218/8 "2018-06-25T11:32:21Z")
This explains everything.
I will try update my Mediawiki again. But I’ve had too many problems. I hope i will fix that problems.
---
### Author:  [@SXX](https://meta.discourse.org/u/SXX)
#### Post date: [6월 27, 2018, 11:35오후 UTC](https://meta.discourse.org/t/use-discourse-sso-with-mediawiki/69218/9 "2018-06-27T23:35:20Z")
I suppose it’s impossible to update OP with my current permissions so I’ll just share some useful details here.
So it’s end up Mediawiki actually using localized identifiers for special page URLs so redirect isn’t really an option once there is non-English UTF-8 in URL. Browsers tend to encode URLs and it’s tricky to make redirection work with either Nginx or Apache configuration.
So instead of adding redirect it’s possible to just hardcode url within Mediawiki in this file:
```plaintext
./includes/skins/SkinTemplate.php
```
Find (line 682 in my version):
```plaintext
$login_url = [
'text' => $this->msg( $loginlink )->text(),
'href' => self::makeSpecialUrl( 'Userlogin', $returnto ),
'active' => $title->isSpecial( 'Userlogin' )
|| $title->isSpecial( 'CreateAccount' ) && $useCombinedLoginLink,
];
```
Then get it to look like this:
```plaintext
$login_url = [
'text' => $this->msg( $loginlink )->text(),
'href' => '/discourse-sso.php',
// 'href' => self::makeSpecialUrl( 'Userlogin', $returnto ),
'active' => $title->isSpecial( 'Userlogin' )
|| $title->isSpecial( 'CreateAccount' ) && $useCombinedLoginLink,
];
```
---
### Author:  [@bekircem](https://meta.discourse.org/u/bekircem)
#### Post date: [9월 3, 2018, 10:21오전 UTC](https://meta.discourse.org/t/use-discourse-sso-with-mediawiki/69218/10 "2018-09-03T10:21:23Z")
It seems logout URL is missing on Mediawiki. Could it be related to SSO?
Edit: I seems Auth remote user extension causes it. Users can’t logout to wiki in this case. How i can fix that?
> **[Extension:Auth remoteuser - MediaWiki](https://www.mediawiki.org/wiki/Extension:Auth_remoteuser)**
---
### Author:  [@SXX](https://meta.discourse.org/u/SXX)
#### Post date: [9월 3, 2018, 9:10오후 UTC](https://meta.discourse.org/t/use-discourse-sso-with-mediawiki/69218/11 "2018-09-03T21:10:59Z")
> [@bekircem](#):
>
> It seems logout URL is missing on Mediawiki. Could it be related to SSO?
That one I didn’t solve since for my project it’s wasn’t important. If you have issues with security then it’s better to just patch SSO code to bind session to IP or reset auth after shorter period of time. After all it’s easy to login just by clicking on URL.
---
### Author:  [@bekircem](https://meta.discourse.org/u/bekircem)
#### Post date: [9월 3, 2018, 9:14오후 UTC](https://meta.discourse.org/t/use-discourse-sso-with-mediawiki/69218/12 "2018-09-03T21:14:57Z")
That was bad. ☹
---
### Author:  [@michael](https://meta.discourse.org/u/michael)
#### Post date: [11월 15, 2018, 10:18오전 UTC](https://meta.discourse.org/t/use-discourse-sso-with-mediawiki/69218/13 "2018-11-15T10:18:55Z")
Curious how this is working out for you if you’re still using this.
---
### Author:  [@jhf2442](https://meta.discourse.org/u/jhf2442)
#### Post date: [3월 25, 2019, 4:45오후 UTC](https://meta.discourse.org/t/use-discourse-sso-with-mediawiki/69218/14 "2019-03-25T16:45:39Z")
Anyone using this “as is” ? in addNonce function, the query
```
$this->mysqli->query("INSERT INTO ".SSO_DB_TABLE." (`id`, `nonce`, `logged`, `expire`) VALUES (NULL, '$nonce', '0', '".$expire."');");
```
fails because : `#1364 - Field 'admin' doesn't have a default value` and actually, the definition for the field in $sqlStructure says `admin Tinyint(1) NOT NULL` ☹
(same for “moderator” field BTW)
Working code 🙂
```
$this->mysqli->query("INSERT INTO ".SSO_DB_TABLE." (`id`, `nonce`, `logged`, `expire`,`admin`,`moderator`) VALUES (NULL, '$nonce', '0', '".$expire."',0,0);");`
```
---
### Author:  [@Boost](https://meta.discourse.org/u/Boost)
#### Post date: [8월 30, 2019, 12:23오후 UTC](https://meta.discourse.org/t/use-discourse-sso-with-mediawiki/69218/15 "2019-08-30T12:23:52Z")
I made a version of this that uses PostgreSQL and has functionality for logging out: [GitHub - hhyyrylainen/singlefile-discourse-sso-php: Ugly, but working single-file SSO implementation in PHP · GitHub](https://github.com/hhyyrylainen/singlefile-discourse-sso-php)
I hopefully didn’t make any security related mistakes.
---
### Author:  [@sunjam](https://meta.discourse.org/u/sunjam)
#### Post date: [4월 22, 2020, 6:16오후 UTC](https://meta.discourse.org/t/use-discourse-sso-with-mediawiki/69218/16 "2020-04-22T18:16:46Z")
멋지다 @Boost, 마스터 브랜치로 병합해야겠다! 잘했고, 고마워.
---
### Author:  [@SXX](https://meta.discourse.org/u/SXX)
#### Post date: [8월 2, 2021, 10:46오전 UTC](https://meta.discourse.org/t/use-discourse-sso-with-mediawiki/69218/17 "2021-08-02T10:46:11Z")
로그아웃 지원 관련 변경 사항은 병합했지만, Postgres는 테스트가 필요해서 아직 병합하지 않았습니다.
참고: mediawiki 확장인 Auth\_remoteuser는 좀 엉망입니다. 관리자 권한을 설정해도 다른 사용자의 권한을 관리할 수 없기 때문입니다.