# Use Discourse SSO with Mediawiki

**URL:** <https://meta.discourse.org/t/use-discourse-sso-with-mediawiki/69218>\
**Category:** Administrators\
**Tags:** sso, how-to\
**Created:** [September 1, 2017, 4:57pm UTC](https://meta.discourse.org/t/use-discourse-sso-with-mediawiki/69218 "2017-09-01T16:57:44Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![SXX](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sxx/32/119649_2.png) [@SXX](https://meta.discourse.org/u/SXX)\
**Post date:** [September 1, 2017, 4:57pm UTC](https://meta.discourse.org/t/use-discourse-sso-with-mediawiki/69218/1 "2017-09-01T16:57:44Z")

</div>

While trying to find ready-to-use solution I’ve seen multiple questions on Internet about that and at least one topic on this forum. I also need to integrate [Discourse SSO](https://meta.discourse.org/t/13045?silent=true) with Mantis Bug Tracker so I decide to go with more generic code that I might reuse for Mantis as well. Code is very ugly, but it’s works and might help someone.

### Read the instruction and activate SSO provider in Discourse

> [@Use Discourse as an identity provider (SSO, DiscourseConnect)](https://meta.discourse.org/t/using-discourse-as-a-sso-provider/32974):
>
> So you want to use Discourse as an identity provider for your own web app? Great! Let’s get started. Enable [DiscourseConnect](https://meta.discourse.org/t/13045?silent=true) provider setting Under Discourse admin site settings (/admin/site\_settings) enable setting enable discourse connect provider and add a secret string to discourse connect provider secrets (used to hash SSO payloads). Implement [DiscourseConnect](https://meta.discourse.org/t/13045?silent=true) in your web app: Generate a random [nonce](https://en.wikipedia.org/wiki/Cryptographic_nonce). Let’s call this value NONCE. Save it temporarily so that you can verify it with the …

### Install Auth\_remoteuser extension for MediaWiki

More information about extension:

> **[Extension:Auth remoteuser - MediaWiki](https://www.mediawiki.org/wiki/Extension:Auth_remoteuser)**

Make sure to check instructions so you can adjust it’s settings for your needs.

Mirror on GitHub:

> **[GitHub - wikimedia/mediawiki-extensions-Auth\_remoteuser: Github mirror of MediaWiki extension...](https://github.com/wikimedia/mediawiki-extensions-Auth_remoteuser)**
>
> Github mirror of MediaWiki extension Auth\_remoteuser - our actual code is hosted with Gerrit (please see https://www.mediawiki.org/wiki/Developer\_access for contributing)

You can clone extension from github into your wiki directory:

```plaintext
git clone https://github.com/wikimedia/mediawiki-extensions-Auth_remoteuser.git /path/to/mediawiki/extensions/Auth_remoteuser

```

### Install [Discourse SSO](https://meta.discourse.org/t/13045?silent=true) client script

1. Get script from GitHub:  
[GitHub - ArseniyShestakov/singlefile-discourse-sso-php: Ugly, but working single-file SSO implementation in PHP · GitHub](https://github.com/ArseniyShestakov/singlefile-discourse-sso-php)
2. Copy `discourse-sso.php` into directory with your wiki.
3. Edit defines on top of file according to your need.
4. To create database table and test it visit `https://your.wiki.domain/discourse-sso.php`

You can check databse table contents from command line:

```plaintext
mysql -u wikiuser -pPASSWORD wikidb -e "SELECT * FROM sso_login;"

```

If everything is fine you’ll see username / email and other information here.

### Edit LocalSettings.php

First of all make sure you set `createaccount` and `autocreateaccount` permissions properly:

```plaintext
// Forbid account creation by users
$wgGroupPermissions['*']['createaccount'] = false;
// Allow extensions to manage users
$wgGroupPermissions['*']['autocreateaccount'] = true;

```

After that you’ll need to add code like this to the end of wiki configuration file:

```plaintext
// Discourse authentification
require_once( "$IP/discourse-sso.php" );
$DISCOURSE_SSO = new DiscourseSSOClient();
$SSO_STATUS = $DISCOURSE_SSO->getAuthentication();
if(true === $SSO_STATUS['logged'] && !empty($SSO_STATUS['data']['username']))
{
        $wgAuthRemoteuserUserName = $SSO_STATUS['data']['username'];

        $wgAuthRemoteuserUserPrefs = [
                'email' => $SSO_STATUS['data']['email']
        ];
// $wgAuthRemoteuserUserPrefsForced = [
// 'email' => $SSO_STATUS['data']['email']
// ];

        if(!empty($SSO_STATUS['data']['name']))
        {
                $wgAuthRemoteuserUserPrefs['realname'] = $SSO_STATUS['data']['name'];
// $wgAuthRemoteuserUserPrefsForced['realname'] = $SSO_STATUS['data']['name'];
        }
        wfLoadExtension( 'Auth_remoteuser' );
}

```

If you uncomment lines with `force` email / name will be changed not just for newly automatically-created users, but also for existing wiki users.

### Test it

Now after you visit `https://your.wiki.domain/discourse-sso.php` you should be redirected to your wiki and you’ll be logged-in.

### Redirect Login URL to SSO script:

I not yet find best easy to change login url so I just used following redirect via nginx:

```plaintext
        if ($request_uri ~* "^.*Special:UserLogin.*$") {
                return 302 https://your.wiki.domain/discourse-sso.php;
        }

```

### To be continued…

This is only tested on wiki of project I worked on and likely . **Use on your own risk!**

I’ll try to improve this guide as soon as I find better ways to integrate it into Mediawiki.

---

_[View the full topic](https://meta.discourse.org/t/use-discourse-sso-with-mediawiki/69218)._