Discourse

Discourse#

Let a Discourse forum sign its users in with accounts from your Plone site, using the OpenID Connect plugin that ships with Discourse.

Note

Verified on 2026-09-24.

The examples use https://id.example.org as the issuer and https://forum.example.org as the forum.

1. Register the client#

Follow Register an OAuth client with:

Field	Value
Redirect URI	`https://forum.example.org/auth/oidc/callback`
Grant	Authorization code
Scope	`openid`, `profile`, `email`
Secret	Yes. Discourse is a confidential client

Capture the client secret from the response. It is shown once.

2. Configure Discourse#

As an administrator, open /admin/config/login-and-authentication/oidc on the forum, or search the site settings for openid_connect. Set each setting, in the order the page lists them:

Setting	Value
OpenID Connect enabled	on
OpenID Connect discovery document	`https://id.example.org/.well-known/openid-configuration`
OpenID Connect client ID	The client ID from step 1
OpenID Connect client secret	The client secret from step 1
OpenID Connect rp initiated logout	off. This server has no `end_session_endpoint`
OpenID Connect rp initiated logout redirect	empty
OpenID Connect rp initiated logout include client ID	off
OpenID Connect allow association change	on while existing users move over, then off
OpenID Connect overrides email	on to keep each forum address in step with your site at every sign-in; off to let people keep a different address on the forum
OpenID Connect authorize scope	`openid profile email`
OpenID Connect verbose logging	on while you test, then off
OpenID Connect token scope	empty. This server takes the scope from the authorization, and ignores one sent to the token endpoint
OpenID Connect error redirects	empty
OpenID Connect authorize parameters	empty
OpenID Connect claims	empty. This server releases claims by scope
OpenID Connect match by email	on
OpenID Connect groups claim	`groups`, or empty to leave groups out
OpenID Connect user field mappings	empty, or map `website` or `description` onto a Discourse user field
OpenID Connect use pkce	off. This recipe has not been run with it on; this server accepts the `S256` method only
OpenID Connect mtls client cert	empty. This server authenticates a client by its secret
OpenID Connect mtls client key	empty
OpenID Connect mtls client key passcode	empty

Discourse reads the endpoints and the token endpoint authentication from the discovery document.

Verify#

Sign out of Discourse and open its login dialog. It offers the OpenID Connect button.
Choosing it takes you to your Plone site, which asks you to approve the forum once.
You come back to Discourse signed in. A first sign-in offers the account creation form, filled in from preferred_username and name.

Known quirks#

Matching by email depends on email_verified. Discourse attaches a sign-in to an existing forum account with the same address, unless email_verified is false. This server sends true only for an address it holds as verified, so a user whose address is unverified here gets a new forum account instead. See About email verification.
Existing users can link by hand. With OpenID Connect allow association change on, a signed-in user can connect their forum account from their preferences, whatever their address. It also lets them disconnect it, so turn it off once everybody has moved.
Username and name are suggestions. Discourse uses preferred_username and name only when it creates an account.
Logout ends only the forum session. This server has no end_session_endpoint, so leave OpenID Connect rp initiated logout off.
Groups: with OpenID Connect groups claim set to groups, Discourse records the Plone groups as associated groups, and a Discourse group can be tied to one for automatic membership. The claim carries only the groups your site releases. See Claims released by the server layer.