You should start by checking the relevant google documentation.

As of writing, this is what their doc says:

Using the email, email_verified and hd fields, you can determine if Google hosts and is authoritative for an email address. In the cases where Google is authoritative, the user is known to be the legitimate account owner, and you may skip password or other challenge methods.

Cases where Google is authoritative:

email has a @gmail.com suffix, this is a Gmail account.
email_verified is true and hd is set, this is a Google Workspace account.

Users may register for Google Accounts without using Gmail or Google Workspace. When email does not contain a @gmail.com suffix and hd is absent, Google is not authoritative and password or other challenge methods are recommended to verify the user. email_verified can also be true as Google initially verified the user when the Google account was created, however ownership of the third party email account may have since changed.

So in this case, you want to check that hd is set as well as that email_verified is true.

With FusionAuth, you can check this using a reconcile lambda and looking at the id_token:

• https://fusionauth.io/docs/extend/code/lambdas/google-reconcile
• https://fusionauth.io/docs/extend/code/lambdas/openid-connect-response-reconcile

What claims should I check when using google as an identity provider when I'm interested in making sure it is a google workspace account?

We have a docs MCP server.

This lets your MCP compatible IDE or client ask questions of all the FusionAuth docs, YouTube videos, Terraform provider, OpenAPI spec and more.

More details: https://fusionauth.io/docs/get-started/download-and-install/development/docs-mcp-server

@vijaysingh1784 Looks like you have done a bit of research your self and made a pretty good analysis. I am not very familiar with MojoAuth, but just to confirm a few things:

• FusionAuth is very customizable. You should check out things like Lambdas, Webhooks and other various options.

• FusionAuth can be self-hosted or can be hosted for you.

• FusionAuth handles SAML, SCIM and other various integrations.

• FusionAuth is very scalable and gives you great control with api acess and other mechanisms.

• Depending on your needs, FusionAuth can be as easy to self host as spinning up a docker image to a full blown complex K8s deployment. It should fit your needs there.

• While there is no direct migration guide for the product you are talking about, there are several other migration guides for you to look over that should give you an idea on how to do it.

@biwi It sounds like the keys may have gotten switched or something odd. Is it possible to wipe everything out at try again from scratch? Also, check out this blog post as it may be useful for you as well.

Note that this functionality (logging in with a phone number) was delivered in 1.59.

More details here: https://fusionauth.io/blog/announcing-fusionauth-1-59

@bianca-wittig Can you please describe the steps you are taking in a little more detail. It may help us understand your question a little better.

@manoj-patil said in We are getting ERROR org.primeframework.mvc.PrimeMVCRequestHandler - Error encountered:

t F ... 63 common frame

Under what circumstances and you receiving this error?

Hi FusionAuth community,

We just released a preview MCP server that allows you to control a FusionAuth instance from within any MCP client (Cursor, Claude Desktop, any agent that uses MCP, etc).

You can see the announcement blog post here: https://fusionauth.io/blog/fusionauth-mcp-server

And the GitHub repo, which includes installation instructions, is here: https://github.com/FusionAuth/fusionauth-mcp-api/

We'd love your feedback; feel free to leave it here.

@chad-hurd Awesome that you got if figured out. Do you mind sharing what, specifically, was wrong with the setup? It may help others down the road.