{"id":18707580,"url":"https://github.com/discourse/discourse-saml","last_synced_at":"2025-10-23T23:37:07.733Z","repository":{"id":3692248,"uuid":"50599123","full_name":"discourse/discourse-saml","owner":"discourse","description":"Support for SAML in Discourse","archived":false,"fork":false,"pushed_at":"2025-03-17T19:21:59.000Z","size":552,"stargazers_count":41,"open_issues_count":3,"forks_count":46,"subscribers_count":22,"default_branch":"main","last_synced_at":"2025-03-30T06:09:59.010Z","etag":null,"topics":["discourse","discourse-plugin","idp","saml"],"latest_commit_sha":null,"homepage":"","language":"Ruby","has_issues":false,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/discourse.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2016-01-28T17:09:24.000Z","updated_at":"2025-03-17T19:22:01.000Z","dependencies_parsed_at":"2023-07-05T19:01:45.375Z","dependency_job_id":"4b736426-31c3-4a3f-93ee-4f13cba9596d","html_url":"https://github.com/discourse/discourse-saml","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/discourse%2Fdiscourse-saml","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/discourse%2Fdiscourse-saml/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/discourse%2Fdiscourse-saml/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/discourse%2Fdiscourse-saml/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/discourse","download_url":"https://codeload.github.com/discourse/discourse-saml/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247445682,"owners_count":20939961,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["discourse","discourse-plugin","idp","saml"],"created_at":"2024-11-07T12:18:58.337Z","updated_at":"2025-10-23T23:37:07.728Z","avatar_url":"https://github.com/discourse.png","language":"Ruby","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003e ⚠ Discourse has successfully integrated with SAML for many enterprises, but SAML integration is often complex, error prone, and typically requires customization / changes for that organization's _specific implementation_ of SAML. This work is best undertaken by software developers familiar with Discourse. We are highly familiar with Discourse, and available to do that work [on an enterprise hosting plan](https://discourse.org/buy).\n\n### About\n\nA Discourse Plugin to enable authentication via SAML\n\nSetting up your idp:\nThe entity-id should be: `http://example.com`\nThe consumer assertion service url should be: `https://example.com/auth/saml/callback`\n\nYou may need to set your idp to send an extra custom attribute 'screenName', that will become the users id.\n\nFor idp-initated SSO, use the following URL:\n`https://example.com/auth/saml/callback`\n\n### Configuration\n\nFor Docker based installations:\n\nAdd the following settings to your `app.yml` file in the Environment Settings section:\n\n```\n## Saml plugin setting\n  DISCOURSE_SAML_TARGET_URL: https://idpvendor.com/saml/login/\n  DISCOURSE_SAML_CERT_FINGERPRINT: \"43:BB:DA:FF...\"\n  #DISCOURSE_SAML_REQUEST_METHOD: post\n  #DISCOURSE_SAML_FULL_SCREEN_LOGIN: true\n  DISCOURSE_SAML_CERT: \"-----BEGIN CERTIFICATE-----\n  ...\n  -----END CERTIFICATE-----\"\n```\nOnly one of `DISCOURSE_SAML_CERT_FINGERPRINT` or `DISCOURSE_SAML_CERT` needed.\n\nThe `DISCOURSE_FULL_SCREEN_LOGIN` option allows the SSO login page to be presented within the main browser window, rather than a popup. If SAML is your only authentication method this can look neater, as when the user clicks the Log In button the login page will follow through within the main browser window rather than opening a pop-up. This setting is commented out by default - if you want full screen login uncomment that line and set the value to true (as per the example above).\n\nFor non docker:\n\nAdd the following settings to your `discourse.conf` file:\n\n- `saml_target_url`\n\n### Group sync\n\n- `DISCOURSE_SAML_SYNC_GROUPS`: Sync groups. Defaults to false.\n- `DISCOURSE_SAML_GROUPS_ATTRIBUTE`: SAML attribute to use for group sync. Defaults to `memberOf`, and accepts '|' separated attributes `Country|Department`.\n- `DISCOURSE_SAML_GROUPS_FULLSYNC`: Should the assigned groups be completely synced including adding AND removing groups based on the IDP? Defaults to false. If set to true, `DISCOURSE_SAML_SYNC_GROUPS_LIST` and SAML attribute `groups_to_add`/`groups_to_remove` are not used.\n- `DISCOURSE_SAML_GROUPS_LDAP_LEAFCN`: If your IDP transmits `cn=groupname,cn=groups,dc=example,dc=com` you can set this to true to use only `groupname`. This is useful if you want to keep the standard group name length of Discourse (20 characters).\n- `DISCOURSE_SAML_SYNC_GROUPS_LIST`: Groups mentioned in this list are synced if they are referenced by the IDP (in `memberOf` SAML attribue). Any other groups will not be removed/updated.\n- `DISCOURSE_SAML_GROUPS_USE_FULL_NAME`: If set to true, will match groups based on Discourse Group `full_name` instead of the default `name`. This allows usage of group names with spaces in them, e.g. \"North Africa\" instead of \"north_africa\".\n\n### Other Supported settings\n\n- `DISCOURSE_SAML_SP_CERTIFICATE`: SAML Service Provider X.509 certificate. Used to sign messages once enabled via the `DISCOURSE_SAML_*_SIGNED` settings\n- `DISCOURSE_SAML_SP_PRIVATE_KEY`: SAML Service Provider X.509 private key. Used to sign messages once enabled via the `DISCOURSE_SAML_*_SIGNED` settings\n- `DISCOURSE_SAML_AUTHN_REQUESTS_SIGNED`: defaults to false\n- `DISCOURSE_SAML_WANT_ASSERTIONS_SIGNED`: defaults to false\n- `DISCOURSE_SAML_LOGOUT_REQUESTS_SIGNED`: defaults to false\n- `DISCOURSE_SAML_LOGOUT_RESPONSES_SIGNED`: defaults to false\n- `DISCOURSE_SAML_NAME_IDENTIFIER_FORMAT`: defaults to \"urn:oasis:names:tc:SAML:2.0:protocol\"\n- `DISCOURSE_SAML_DEFAULT_EMAILS_VALID`: defaults to true\n- `DISCOURSE_SAML_VALIDATE_EMAIL_FIELDS`: defaults to blank. This setting accepts pipe separated group names that are supplied in `memberOf` attribute in SAML payload. If the group name specified in the value matches that from `memberOf` attribute than the `email_valid` is set to `true`, otherwise it defaults to `false`. This setting overrides `DISCOURSE_SAML_DEFAULT_EMAILS_VALID`.\n- `DISCOURSE_SAML_BUTTON_TITLE`: 'with SAML'\n- `DISCOURSE_SAML_TITLE`: 'SAML'\n- `DISCOURSE_SAML_SYNC_MODERATOR`: defaults to false. If set to `true` user get moderator role if SAML attribute `isModerator` (or attribute specified by `DISCOURSE_SAML_MODERATOR_ATTRIBUTE`) is 1 or true.\n- `DISCOURSE_SAML_MODERATOR_ATTRIBUTE`: defaults to `isModerator`\n- `DISCOURSE_SAML_SYNC_ADMIN`: defaults to false. If set to `true` user get admin role if SAML attribute `isAdmin` (or attribute specified by `DISCOURSE_SAML_ADMIN_ATTRIBUTE`) is 1 or true.\n- `DISCOURSE_SAML_ADMIN_ATTRIBUTE`: defaults to `isAdmin`\n- `DISCOURSE_SAML_SYNC_TRUST_LEVEL`: defaults to false. If set to `true` user's trust level is set to the SAML attribute `trustLevel` (or attribute specified by `DISCOURSE_SAML_TRUST_LEVEL_ATTRIBUTE`) which needs to be between 1 and 4.\n- `DISCOURSE_SAML_TRUST_LEVEL_ATTRIBUTE`: defaults to `trustLevel`\n\n### Converting an RSA Key to a PEM\n\nIf the idp has an RSA key split up as modulus and exponent, this javascript library makes it easy to convert to pem:\n\nhttps://www.npmjs.com/package/rsa-pem-from-mod-exp\n\n### Moving from environment variables to Site Settings\n\nWith the Environment variables set, run this snippet in the rails console:\n\n```ruby\nSiteSetting.defaults.all.keys.each do |k|\n  next if !k.to_s.start_with?(\"saml_\")\n  if val = GlobalSetting.try(k)\n    puts \"Setting #{k} to #{val} in the database\"\n    SiteSetting.add_override!(k, val)\n  end\nend;\nSiteSetting.saml_enabled = true\n```\n\nThen remove the environment variables and restart the server. The plugin will now be using site settings which can be modified in the admin UI.\n\n### License\n\nMIT\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdiscourse%2Fdiscourse-saml","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdiscourse%2Fdiscourse-saml","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdiscourse%2Fdiscourse-saml/lists"}