I am integrating 3rd party Azure AD idps using OIDC as per the instructions here. I have elected to use the link on email strategy with a user that must exist in FusionAuth prior to linking. This works nicely and I can use the API to retrieve the link for a user when I've used Azure AD to authenticate at least once.

I have also set up a webhook for the user.identity-provider.link event. This works well when tested using the button in the UI, but never seems to fire for the actual live event in the above scenario - my webhook is never called. Below are some screenshots of the webhook configuration. Perhaps someone could verify that I've not missed anything that would explain the absent event?

Settings -> Webhooks

Tenants -> id -> Webhooks

I'm not sure this last enablement is required given the global setting, but it doesn't seem to make any difference either way - on or off.

My FusionAuth version is 1.40.2 running in Docker.

Thanks in advance for any ideas.

@mark-robustelli thanks for the response, I didn't see it at the time hence the rather slow reply. I was using the version of Retrieve a Link that takes IDP id and FusionAuth user ID. The response to that call contains non-null non-empty values for all the following properties nested within an array of identityProviderLink instances:

• displayName
• identityProviderId
• identityProviderName
• identityProviderType
• identityProviderUserId
• insertInstant
• lastLoginInstant
• tenantId
• userId

The only field returned with a consistently blank string value is identityProviderLink.token. This is documented as containing the "The token returned from the identity provider". I guess that could mean any of a number of tokens, but I assumed it to mean the access token response?

Debug logs show an AAD Access Token Response structure that contains populated values for access_token and id_token.

We are using themed versions of the FusionAuth login pages, though we're also using idp hints on the login URL to bypass the login forms in the instance where a user is authenticated by a 3rd party IDP.

We are using Azure AD as an external identity provider via the OIDC integration, which works great and users are authenticated as expected, happy days.

We have recently however had a customer request that would require us to retrieve the access token returned from Azure AD for further processing. We can see from the debug logs that the access token is returned from Azure AD, but using the Retrieve a Link API yields an empty token property in the response in all instances. While the API documentation does say that the token may not be available in all cases, other documentation specifically for the Azure AD OIDC integration details a token storage step in the authentication flow. Have we misinterpreted the documentation here or should the token be available?

Hi Josh,

Thanks for taking the time to reply. In the scenario outlined I perhaps didn't mention that the users I was expecting the webhook to fire for already existed in FusionAuth prior to Azure AD sign-in. Should I expect the event to trigger in that instance?

Regards
Stefan

I am integrating 3rd party Azure AD idps using OIDC as per the instructions here. I have elected to use the link on email strategy with a user that must exist in FusionAuth prior to linking. This works nicely and I can use the API to retrieve the link for a user when I've used Azure AD to authenticate at least once.

I have also set up a webhook for the user.identity-provider.link event. This works well when tested using the button in the UI, but never seems to fire for the actual live event in the above scenario - my webhook is never called. Below are some screenshots of the webhook configuration. Perhaps someone could verify that I've not missed anything that would explain the absent event?

Settings -> Webhooks

Tenants -> id -> Webhooks

I'm not sure this last enablement is required given the global setting, but it doesn't seem to make any difference either way - on or off.

My FusionAuth version is 1.40.2 running in Docker.

Thanks in advance for any ideas.