Sign in with NobleID on Discourse

Register on NobleID

1. In Dashboard → OAuth apps, register a confidential app. You need two-step login on your NobleID to do this.
2. Add this redirect URI, with your own host:
   https://forum.example.org/auth/oidc/callback
   Your forum's base URL, including any subfolder, followed by /auth/oidc/callback.
3. Tick these scopes: OpenID (always on), Profile profile, Email email. The platform asks for these, and sign-in stops if it asks for a scope the app does not have.
4. Copy the client ID and the client secret. The secret is shown once.

The app works at once. Until NobleID verifies it, people see a “not verified” notice on the consent screen.

Settings

Admin → Login & authentication → OIDC, or search all site settings for openid connect:

Discourse reads every endpoint from the discovery document, including the authorization endpoint on www.nobleid.org.

How Discourse behaves with NobleID

• It authenticates with client_secret_basic, chosen from discovery.
• It checks the ID token's iss, aud, exp and nonce, but not its signature: it trusts the token because it came straight from NobleID's token endpoint. It then calls userinfo and refuses the sign-in if the two sub values differ.
• Accounts are keyed on sub. Changing the NobleID email or username does not create a second Discourse account.
• It links to an existing account by email only when email_verified is true. Keep email verified claim fallback off, so a missing claim counts as unconfirmed.
• If the person unticks email, Discourse asks them for an email and confirms it itself.

openid connect overrides email: when on, every sign-in replaces the Discourse email with the one NobleID sends. Turn it on only if NobleID is the only way into the forum.

With rp initiated logout off, logging out of Discourse ends the Discourse session only, and the person stays signed in at nobleid.org. With it on, Discourse also sends the person to NobleID, which asks them to confirm. To bring them back to the forum, set rp initiated logout redirect and add that exact URL to the app's sign-out return URLs in the NobleID dashboard.

Fill the profile from NobleID

Discourse uses these when it creates the account. Later sign-ins change the email only with openid connect overrides email on (see above).

Every claim, and how to fill a profile without overwriting what people edit: Fill your app's profile from NobleID.

Before you go live

• Sign in once with your own NobleID. People need a first and last name on their NobleID profile to sign in; NobleID asks for it if it is missing.
• Key accounts on sub. Link to an existing account by email only when email_verified is true.
• Remove any localhost redirect URIs from the app.
• Keep the client secret out of version control.

NobleID values