Google Reconcile Lambda

When a Google identity provider is used to complete a federated login request, FusionAuth will use the configured linking strategy to reconcile the user. FusionAuth will attempt to match the user information returned from the Google identity provider to an existing user account or create a new one.

You may optionally utilize a lambda to customize the user and user registration during the authentication event.

When you create a new lambda using the FusionAuth Admin UI, you will be provided an empty function to implement.

Starting in version 1.65.0, you can use attribute mappings to map IdP claims directly to FusionAuth user and registration fields without writing a lambda. Reconcile lambdas and attribute mappings are mutually exclusive. Attempting to configure both on a given IdP results in a validation error.

Lambda Structure#

When you create the lambda with the API, give the function the following signature:

function reconcile(user, registration, idToken, context) {
  // Lambda code goes here
}

This lambda must contain a function named reconcile that accepts the following parameters:

• user: the FusionAuth User object. You can modify this object. However, you can't change the email or username attributes after FusionAuth links the user.
• registration: the FusionAuth UserRegistration object. You can modify this object.

• idToken: the JSON payload returned by the Google Token Info API. This object is read-only.
• context: Available since 1.64.0 an object containing the context of the request, including access to secrets. This object is read-only.

The User API and Registration API documentation describe the user and registration objects. The idToken object can include user claims for the lambda to read.

Assigning The Lambda#

After you create the lambda, assign the lambda to the Google identity provider.

Navigate to Settings -> Identity Providers . Select your existing Google configuration. If you haven't configured Google yet, click Add provider and select Google.

Default Lambda#

FusionAuth includes a default Google reconcile lambda. You can use the default lambda as is or change the lambda:

// This is the default Google reconcile, modify this to your liking.
function reconcile(user, registration, idToken) {
  // Un-comment this line to see the idToken object printed to the event log
  // console.info(JSON.stringify(idToken, null, 2));

  // The idToken is the response from the tokeninfo endpoint
  // https://developers.google.com/identity/sign-in/web/backend-auth#calling-the-tokeninfo-endpoint
  user.firstName = idToken.given_name;
  user.lastName = idToken.family_name;
  user.fullName = idToken.name;
  user.imageUrl = idToken.picture;
}

Example Lambda#

The default lambda overwrites each profile field, even when Google leaves a claim out. The following lambda keeps the saved value when a claim is missing.

Google includes the hd claim only for Google Workspace accounts, and the claim holds the Workspace domain. The lambda adds the employee role to the registration when hd is example.com. Personal Google accounts get no extra role. Replace example.com with your Workspace domain.

// fills in the profile and gives users from your Google Workspace domain the employee role
function reconcile(user, registration, idToken, context) {
  // keep the saved value when google leaves a claim out
  user.firstName = idToken.given_name || user.firstName;
  user.lastName = idToken.family_name || user.lastName;
  user.fullName = idToken.name || user.fullName;
  user.imageUrl = idToken.picture || user.imageUrl;

  // hd is only present for google workspace accounts
  var roles = registration.roles || [];
  if (idToken.hd === 'example.com' && roles.indexOf('employee') === -1) {
    roles.push('employee');
  }
  registration.roles = roles;
}