# 让 Discourse 作为 OIDC （OAuth 2.0） 提供者

**URL:** <https://www.isharkfly.com/t/discourse-oidc-oauth-2-0/17225>\
**Category:** Discourse\
**Tags:** discourse\
**Created:** [April 22, 2025, 7:26pm UTC](https://www.isharkfly.com/t/discourse-oidc-oauth-2-0/17225 "2025-04-22T19:26:06Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kokomi](https://www.isharkfly.com/user_avatar/www.isharkfly.com/kokomi/32/16765_2.png) [@Kokomi](https://www.isharkfly.com/u/Kokomi)\
**Post date:** [April 22, 2025, 7:26pm UTC](https://www.isharkfly.com/t/discourse-oidc-oauth-2-0/17225/1 "2025-04-22T19:26:06Z")

</div>

> [@以社区为纽带的捆绑方式](https://www.isharkfly.com/t/topic/16323/2):
>
> 不太清楚他们用的是什么方式的配置的。

花了一个月，终于是找到能实现这种效果的项目了。  
[Parkour-Vienna/distrust：将 discourse 用作 OIDC （OAuth 2.0） 提供者 — Parkour-Vienna/distrust: Use discourse as an OIDC (OAuth 2.0) provider](https://github.com/Parkour-Vienna/distrust)

这个项目的作用是，作为Discourse SSO Provider和OAuth 2.0的中转器，让你在其他网站上能够配置“使用Discourse账号登录”。

我们用它来连接论坛和 [synctv](https://github.com/synctv-org/synctv)，因为我们有一些定期的直播可以一起看，而Discourse本身的stream插件的侧边栏聊天在人多了之后会很卡。

配置这个也遇到过很多坑，我推荐在clerk注册一个项目，可以比较方便的调试Oauth。

---

<div class="post-metadata">

**Author:** ![VegaMonika](https://www.isharkfly.com/user_avatar/www.isharkfly.com/vegamonika/32/14424_2.png) [@VegaMonika](https://www.isharkfly.com/u/VegaMonika)\
**Post date:** [April 22, 2025, 11:16pm UTC](https://www.isharkfly.com/t/discourse-oidc-oauth-2-0/17225/2 "2025-04-22T23:16:25Z")

</div>

所以这个上做什么

---

<div class="post-metadata">

**Author:** ![luobo](https://www.isharkfly.com/user_avatar/www.isharkfly.com/luobo/32/15604_2.png) [@luobo](https://www.isharkfly.com/u/luobo)\
**Post date:** [April 23, 2025, 8:21am UTC](https://www.isharkfly.com/t/discourse-oidc-oauth-2-0/17225/3 "2025-04-23T08:21:23Z")

</div>

卧槽，终于有这种项目了，之前就很羡慕隔壁的LinuxDo他们可以提供OIDC，问了之后是他们自己开发的插件。

---

<div class="post-metadata">

**Author:** ![Kokomi](https://www.isharkfly.com/user_avatar/www.isharkfly.com/kokomi/32/16765_2.png) [@Kokomi](https://www.isharkfly.com/u/Kokomi)\
**Post date:** [April 23, 2025, 10:46am UTC](https://www.isharkfly.com/t/discourse-oidc-oauth-2-0/17225/4 "2025-04-23T10:46:55Z")

</div>

比方说，Discourse可以配置使用github账号登录，在这个过程中github作为OIDC 提供者。  
这个项目的作用是，利用Discourse本身自带的sso提供者功能，让协议从特殊的sso转换成常见的OIDC，来适应更多的网站。当用户打开我们的synctv直播站时，就不用重新注册账号，可以直接用Discourse账号登录。

---

<div class="post-metadata">

**Author:** ![VegaMonika](https://www.isharkfly.com/user_avatar/www.isharkfly.com/vegamonika/32/14424_2.png) [@VegaMonika](https://www.isharkfly.com/u/VegaMonika)\
**Post date:** [April 23, 2025, 8:34pm UTC](https://www.isharkfly.com/t/discourse-oidc-oauth-2-0/17225/5 "2025-04-23T20:34:15Z")

</div>

意思就是 ？ Discourse 当成一个 登录账号的提供平台可以然直接搭建的云盘或者其他可以登录的接入 discourse 嘛 那怎么操作呐🤔第一次用这种

---

<div class="post-metadata">

**Author:** ![Kokomi](https://www.isharkfly.com/user_avatar/www.isharkfly.com/kokomi/32/16765_2.png) [@Kokomi](https://www.isharkfly.com/u/Kokomi)\
**Post date:** [April 23, 2025, 9:05pm UTC](https://www.isharkfly.com/t/discourse-oidc-oauth-2-0/17225/6 "2025-04-23T21:05:50Z")

</div>

你用的那个网盘是cloudreve？我看官方演示站支持sso登录，会跳转logto。所以在logto添加自定义oidc提供方 地址就是distrust部署的地址 app\_id和app\_key配置在distrust的config里面。

---

<div class="post-metadata">

**Author:** ![VegaMonika](https://www.isharkfly.com/user_avatar/www.isharkfly.com/vegamonika/32/14424_2.png) [@VegaMonika](https://www.isharkfly.com/u/VegaMonika)\
**Post date:** [April 24, 2025, 3:11am UTC](https://www.isharkfly.com/t/discourse-oidc-oauth-2-0/17225/7 "2025-04-24T03:11:05Z")

</div>

是否步骤是这样的

```auto
cd /opt/1panel/apps/openresty/openresty/www/sites/sso.justnainai.com/index
# 创建distrust.yml
curl -o distrust.yml https://raw.githubusercontent.com/Parkour-Vienna/distrust/main/example/distrust
# 打开distrust.yml写入模版
discourse:
  server: https://www.justnainai.com
  secret: YOUR_SHARED_SECRET  

oidc:
  secret: '12345678901234567890123456789012'  
  privateKey: |
    -----BEGIN RSA PRIVATE KEY-----
    MIICWwIBAAKBgQC9...
    -----END RSA PRIVATE KEY-----

clients:
  sso-client:
    secret: sso123456
    redirectURIs:
      - 'https://openidconnect.net/callback'  

# 生成 32 字节密钥
openssl rand -hex 16

# 使用 distrust 自带命令生成 RSA 密钥
./distrust genkey > key.pem

```

然后去Discourse 后台搜索这些设置：

enable discourse connect provider → 开启

discourse connect provider secrets → 添加：

 ![image](https://com-isharkfly-discourse.s3.dualstack.us-east-2.amazonaws.com/com-isharkfly-www/discourse-uploads/original/3X/1/9/198a411b6af9cf5a0aa2940abb6bb9c63bd06707.png)  
最后  
./distrust 对吧

---

<div class="post-metadata">

**Author:** ![VegaMonika](https://www.isharkfly.com/user_avatar/www.isharkfly.com/vegamonika/32/14424_2.png) [@VegaMonika](https://www.isharkfly.com/u/VegaMonika)\
**Post date:** [April 24, 2025, 3:30am UTC](https://www.isharkfly.com/t/discourse-oidc-oauth-2-0/17225/8 "2025-04-24T03:30:52Z")

</div>

# 呆滞

 ![image](https://cdn.isharkfly.com/com-isharkfly-www/discourse-uploads/original/3X/f/3/f3b8a36af861f7f033eeaf55196a1a347569582d.png)  
 ![image](https://cdn.isharkfly.com/com-isharkfly-www/discourse-uploads/original/3X/7/e/7eedf44ffc6aa0251af8195dd25b45ada89d8f77.png)

```auto
discourse:
  server: https://www.justnainai.com
  secret: XXXXXX

oidc:
  secret: 'd52c3f7f89c84e8da2bd946c2e6f59fa'
  privateKey: |
    -----BEGIN RSA PRIVATE KEY-----
XXXXXX
    -----END RSA PRIVATE KEY-----

clients:
  test:
    secret: foobar
    redirectURIs:
      - 'https://sso.justnainai.com/callback'

```

 ![image](https://cdn.isharkfly.com/com-isharkfly-www/discourse-uploads/original/3X/7/b/7b66eeea6194ae539a0c32cd168e988e807cdad8.png)  
 ![image](https://cdn.isharkfly.com/com-isharkfly-www/discourse-uploads/original/3X/8/2/82192fcafc2ea5bc29d7167a99ec648ecddc8e4c.png)  
 ![image](https://cdn.isharkfly.com/com-isharkfly-www/discourse-uploads/original/3X/e/5/e555c69f4faa497ee223e74de28683f06e797dd6.png)

呆滞中

---

<div class="post-metadata">

**Author:** ![Kokomi](https://www.isharkfly.com/user_avatar/www.isharkfly.com/kokomi/32/16765_2.png) [@Kokomi](https://www.isharkfly.com/u/Kokomi)\
**Post date:** [April 24, 2025, 3:59pm UTC](https://www.isharkfly.com/t/discourse-oidc-oauth-2-0/17225/9 "2025-04-24T15:59:45Z")

</div>

> [@VegaMonika](#):
>
> `redirectURIs`

redirectURIs一般是根据oidc的使用者，例如我这里写的是synctv的地址，你可能需要写logto的地址，反正不会是distrust的地址。

---

<div class="post-metadata">

**Author:** ![Super\_James](https://www.isharkfly.com/user_avatar/www.isharkfly.com/super_james/32/19007_2.png) [@Super\_James](https://www.isharkfly.com/u/Super_James)\
**Post date:** [May 28, 2025, 11:26pm UTC](https://www.isharkfly.com/t/discourse-oidc-oauth-2-0/17225/10 "2025-05-28T23:26:15Z")

</div>

我也做了一个 [https://nodeloc.cc/t/topic/46097](https://nodeloc.cc/t/topic/46097)

演示

[https://conn.nodeloc.cc/apps](https://conn.nodeloc.cc/apps)

---

<div class="post-metadata">

**Author:** ![luobo](https://www.isharkfly.com/user_avatar/www.isharkfly.com/luobo/32/15604_2.png) [@luobo](https://www.isharkfly.com/u/luobo)\
**Post date:** [May 29, 2025, 4:40am UTC](https://www.isharkfly.com/t/discourse-oidc-oauth-2-0/17225/11 "2025-05-29T04:40:44Z")

</div>

你这个好厉害啊，好棒

---

<div class="post-metadata">

**Author:** ![Dummy](https://www.isharkfly.com/letter_avatar_proxy/v4/letter/d/7c8e57/32.png) [@Dummy](https://www.isharkfly.com/u/Dummy)\
**Post date:** [May 29, 2025, 4:53am UTC](https://www.isharkfly.com/t/discourse-oidc-oauth-2-0/17225/12 "2025-05-29T04:53:51Z")

</div>

牛啊牛啊 👍