discourse-debtcollective-sso

This plugin implements our flavor of SSO for Discourse. We use cookie based authentication across subdomains instead of creating sessions between apps. This provides a better experience and fixes auth of sync sessions between Discourse and other apps.

We are keeping the code from the Discourse SSO provider with our extensions, this is for backwards compatibility with our current tools application. We should remove this once we phase out our current tools.

Usage

This plugins exposes two endpoints.

1. GET /session/sso_cookies?return_url=example.com used for login
2. GET /session/sso_cookies/signup?return_url=example.com used for signup

return_url is a required param. If it's missing, it will return 400

To login or signup, other applications will redirect to either of these endpoints, and once the login or the signup is completed, it will redirect back to that URL with the SSO cookie set. Then other applications of the same domain will read the SSO cookie that contains a JWT with the user information.

In development, you will need to run the Discourse server with some special configuration

env DISCOURSE_ENABLE_CORS=true DISCOURSE_DEV_HOSTS=lvh.me DISCOURSE_SSO_JWT_SECRET=jwt-secret rails s

• DISCOURSE_ENABLE_CORS=true allow other apps to make CORS request to Discourse. We use this to be able to logout users from other apps
• DISCOURSE_DEV_HOSTS=lvh.me use a custom domain to make cookies to work. lvh.me redirects all traffic to 127.0.0.1
• DISCOURSE_SSO_JWT_SECRET=jwt-secret this is encryption key for the the JWT cookie. Use the same value between applications

In envs different than development, these variables will be set in the configuration file.

Rebuilding assets on the server

There are cases where want to restart the server in order to see changes. Do to this you need to

1. Get inside the server.
2. Go to the discourse folder. cd /opt/discourse
3. Get into the Discourse docker container. ./launcher enter web
4. Stop unicorn. sv stop unicorn
5. Compile new assets su discourse -c 'bundle exec rake assets:precompile'
6. Upload assets to S3 bundle exec rake s3:upload_assets
7. Start unicorn. sv start unicorn