laktak / discourse-sso

Single Sign On for Discourse with Active Directory

Discourse SSO for AD

Single Sign On (aka SSO, aka Integrated Login) for Discourse with Active Directory.

You can use this app to let your users login using their Windows accounts without them having to enter their password.

Thanks to paully21 for the SSO code.

Deploy

You can either deploy with Visual Studio or simply copy all files to your IIS server (e.g. to /DiscSso).

Make sure that /DiscSso is an application in IIS Manager (convert to application) and that Windows Authentication is enabled (in IIS/Authentication).

Configuration

Prepare Admin

You should create an admin user so you can log in after enabling SSO. Set the username to your AD accountname (without a domain).

Edit your web.config

appSettings:

• Secret: enter your secret, must match the value from discourse in "sso_secret"
• Allow: define the Active Directory groups you wish to give access in the format DOMAIN\GROUPNAME (separated by a comma)
• DiscourseUrl: the URL for your discourse server.

Go to the /discsso/test page to see if everything works before updating Discourse.

Update Discourse

In Admin go to the login section:

• sso_url: the URL pointing to the login page in this app, e.g. http://YOURSERVER/discsso/login
• sso_secret: your secret, same as in appSettings
• enable_sso: must be enabled
• login required: should be enabled to automatically log in your intranet users
• allow new registrations: should be disabled (if you are only using sso)

Troubleshooting

If you lock yourself out you can disable sso again:

./launcher enter app
rails c
irb > SiteSetting.enable_sso = false
irb > exit
exit

Also see https://meta.discourse.org/t/official-single-sign-on-for-discourse/13045

discourse-sso's Issues

Changing AD User Logon Name

Thanks for the great app! I did tweak the code a bit, to use the AD objectGUID of the user for the external_id in discourse.

After I changed a logon name in active directory, and then try to login to the discourse site, it throws the error message "Can't get user DOMAIN\OldName from domain!". When I authenticate, it's as the new username, but the error message contains the old username.

The username/password is accepted when I'm prompted in my browser, and it seems to accept it as correct - since I don't get re-prompted for the login.

Can't logout

Hey,

The Plugin is working fine, the only problem is you can't logout anymore. So as soon you logout, it will direct you to the startpage, where it connect to plugin and directly log you in again. What I want is, click logout and be ask again for username and password. Or a possibility to invalid my session, so I can login as different user without deleting all my cookies.

thanks,
Christian