# What to do with response from Discourse SSO as provider

**URL:** https://meta.discourse.org/t/what-to-do-with-response-from-discourse-sso-as-provider/102004
**Category:** SSO
**Created:** [November 14, 2018, 9:00am UTC](https://meta.discourse.org/t/what-to-do-with-response-from-discourse-sso-as-provider/102004 "2018-11-14T09:00:41Z")
**Posts on this page:** 1
**Showing post:** 3

<div class="post-metadata">

### Author: ![Jesper\_Enemark](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jesper_enemark/32/111051_2.png) [@Jesper\_Enemark](https://meta.discourse.org/u/Jesper_Enemark)
#### Post date: [November 15, 2018, 8:23am UTC](https://meta.discourse.org/t/what-to-do-with-response-from-discourse-sso-as-provider/102004/3 "2018-11-15T08:23:11Z")

</div>

Hey Sam,  
When you say external\_id is stable and trustworthy. Do you mean that it is a unique identifier for the user?

Do you want me to make a user in my system based on the user I get returned?

I am getting a querystring returned as I am understanding, and I only check for authentication in the request / response relation event because of my nonce. From here I do not see how I can create a session cookie.

I have followed Arpit’s guide:

> [@Use Discourse as an identity provider (SSO, DiscourseConnect)](https://meta.discourse.org/t/using-discourse-as-a-sso-provider/32974):
>
> So you want to use Discourse as an identity provider for your own web app? Great! Let’s get started. Enable [DiscourseConnect](https://meta.discourse.org/t/13045?silent=true) provider setting Under Discourse admin site settings (/admin/site\_settings) enable setting enable discourse connect provider and add a secret string to discourse connect provider secrets (used to hash SSO payloads). Implement [DiscourseConnect](https://meta.discourse.org/t/13045?silent=true) in your web app: Generate a random [nonce](https://en.wikipedia.org/wiki/Cryptographic_nonce). Let’s call this value NONCE. Save it temporarily so that you can verify it with the …

but it ends with getting the user returned, and not providing further information about what I could do to create a cookie or token.  
Is there any documentation providing these informations?

Thank you for the reply, means a ton

---

_[View the full topic](https://meta.discourse.org/t/what-to-do-with-response-from-discourse-sso-as-provider/102004)._