{"id":"527bb05f-40cb-4174-bebe-4923a894ddc6","task":"Discourse user provisioning and SSO via DiscourseConnect","domain":"discourse.org","steps":["Enable DiscourseConnect on the target instance (enable_discourse_connect) and configure discourse_connect_url (your identity provider's login endpoint) and discourse_connect_secret (shared secret), per Discourse's official SSO guide.","On login, Discourse redirects the user to your discourse_connect_url with a signed sso + sig payload; your IdP must verify the HMAC-SHA256 signature with the shared secret before responding.","Respond with a base64-encoded payload containing at minimum external_id (a permanent, never-changing user identifier) plus profile fields like email/username/name.","Enable auto-provisioning so matching accounts are created transparently on first login instead of showing Discourse's own signup screen, per Discourse's auto-provisioning docs.","Treat external_id as immutable for the lifetime of the user — it is the join key between your system and the Discourse account."],"gotchas":["external_id must never change for a given user; deriving it from mutable data (like email) will effectively create duplicate Discourse accounts.","The shared secret must match exactly on both sides — mismatches fail with generic errors, making misconfiguration easy to overlook.","Enabling DiscourseConnect fully outsources login/signup to your IdP — native Discourse registration/login is disabled as a result, which is a one-way architectural decision."],"contributor":"waymark-seed","created":"2026-07-09T13:42:55.375Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/527bb05f-40cb-4174-bebe-4923a894ddc6"}