@pradhanv88 I do not see an Identity Provider for BitBucket. You might want to open an issue with the team as a feature request here.

I recently embarked on the journey of integrating FusionAuth into my website, inspired by a discussion in the FusionAuth community forum

@daenerystargaryen56

Hmmm. Do you have any documentation from NextCloud for generic OIDC providers? FusionAuth usually works with generic documentation, so that might be a good place to start looking.

You can also enable debug on the FusionAuth application you are configuring and look in the event log to see if there is more information that might help you debug this issue.

@ghstahl I think we had a similar conversation on Slack 🙂

For future readers, if you want to be able to distinguish how a user logs in (which idp they use), this might be helpful:

If I were you, I'd look at two things:

the user login success event: https://fusionauth.io/docs/extend/events-and-webhooks/events/user-login-success which has the identityProviderId It is provided as an event, so I don't know if it'll work for you, but it will tell you on every login event which idp was used. You could possibly store that off someplace and build a system to exchange an id token for the idp used. I'd have to think more about how that works, but it might be possible. setting up in your own app a 'sign me in' button and not using an idp hint. You'd instead build the authorization URL for each idp and build a link for entry into each navigation area. https://fusionauth.io/docs/apis/identity-providers/openid-connect#complete-an-openid-connect-login You'd let the user login and then come back. The redirect URL could be different and that would be the distinguishing feature.
If a user started at /googlestart, clicked the 'sign me in' button, and arrived back at /googleendpage and had a valid token, the user went through the google process.
If a user started at /secretidp1start, clicked the 'sign me in' button and ended up back at the /secretidp1endpage with a valid token, then the user went through the secret idp 1 process.

@qermezkon Is this similar to this post? https://fusionauth.io/community/forum/topic/2606/error-encountered-with-fast-path-install

@jgerman Sorry I have been out of touch. I just saw this issue come up that sounds like the same thing you are experiencing. Please follow this issue. When the fix is available, please let us know if this solved your issue to. I believe it will.

@admin-9 I'm sorry to hear you're frustrated.

However, I don't know what you mean by a fleet server.

You have a couple of options:

you can test FusionAuth with the database search option, which doesn't require elasticsearch, but offers more limited search capabilities: https://fusionauth.io/docs/lifecycle/manage-users/search/search#using-the-database-search-engine you could use our docker compose examples which are preconfigured to work with opensearch or elasticsearch: https://fusionauth.io/docs/get-started/download-and-install/docker

If you can provide a few more details about what you are trying to accomplish, I might be able to offer more guidance.

@tokyraselison2 Have you taken a look at our quickstart? It doesn't do authorization checks, but the way it sets up the oauth 2 resolver is a bit different than the way you do:

https://github.com/FusionAuth/fusionauth-quickstart-java-springboot-web/blob/main/complete-application/src/main/java/io/fusionauth/quickstart/springweb/config/SecurityConfiguration.java

Are you sure you have set up the JWT to be signed by an RSA key? I don't know about spring, but some other frameworks don't work with HMAC signed JWTs because of the secret sharing problem.

@max-0 can you elaborate further? Are you trying to call the application inside of FusionAuth that you have setup?

To find the clientId and use it to set up OAuth in a Node.js application with FusionAuth, you will typically go through the following steps:

Create an Application in FusionAuth: You need to create an application within the FusionAuth admin UI. During the creation process, FusionAuth will automatically generate a clientId and a clientSecret for your application. These credentials are used to identify your application to the FusionAuth server.

Record the clientId and clientSecret: After creating the application, you should record the clientId and clientSecret provided by FusionAuth. These will be used in your Node.js application to authenticate with the FusionAuth server.

Configure OAuth in Your Node.js Application: In your Node.js application, you will need to configure the OAuth flow. This typically involves setting up routes and using the clientId and clientSecret to exchange an authorization code for an access token.

Here is an example of how you might set up the OAuth flow in a Node.js application using the clientId and clientSecret:

const express = require('express'); const router = express.Router(); const { FusionAuthClient } = require('@fusionauth/typescript-client'); // Replace these with the values you recorded from FusionAuth const clientId = 'your-client-id'; const clientSecret = 'your-client-secret'; const client = new FusionAuthClient('noapikeyneeded', 'http://localhost:9011'); const loginUrl = 'http://localhost:9011/oauth2/authorize?client_id=' + clientId + '&response_type=code&redirect_uri=http%3A%2F%2FyourRedirectUriHere&scope=offline_access'; const logoutUrl = 'http://localhost:9011/oauth2/logout?client_id=' + clientId; // Define your routes here // ... module.exports = router;

In the above code, replace 'your-client-id' and 'your-client-secret' with the actual clientId and clientSecret you obtained from FusionAuth. Also, replace 'http://yourRedirectUriHere' with the redirect URI configured in your FusionAuth application settings.

For more detailed instructions and examples, you can refer to the FusionAuth documentation and blog posts that discuss setting up OAuth in Node.js applications:

Modern Guide to OAuth Single Sign-On (SSO) with FusionAuth Securely Implement OAuth in React Create a Node.js Application with FusionAuth Support Setting Up Single Sign-On for NodeBB Using OAuth and PKCE to Add Authentication to Your Gatsby Site

Remember to keep your clientSecret secure and never expose it in client-side code or public repositories.

@benlibassinan If you host it, the Community Plan is free for unlimited users. https://fusionauth.io/pricing?step=plan&hosting=self-hosting

@mike123 Is this the same question as https://fusionauth.io/community/forum/topic/2581/first-log-in-screen?

@support-2 this will be on your machine that you are running using node.

If you need node installed locally you can use this
https://nodejs.org/en/learn/getting-started/how-to-install-nodejs

If you are on a Mac and use homebrew
https://formulae.brew.sh/formula/node

@alex-patterson The error was just simply 401 Authorized ....

I was also following this guide from the API docs:

Retrieve a User Registration
This API is used to retrieve a single User Registration. This is the information about a User for a single Application.

Request
Retrieve a User Registration for the User Id and Application Id
GET/api/user/registration/{userId}/{applicationId}
Request Parameters
applicationId
[UUID]
Required
The Id of the Application that the User is registered for.

userId
[UUID]
Required
The Id of the User whose registration is being retrieved.

Request Headers
X-FusionAuth-TenantId
[String]
Optional
The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.

Response
The response for this API contains the User Registration.

Code Description
200 The request was successful. The response will contain a JSON body.
400 The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present.
401 You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.
404 The object you requested doesn't exist. The response will be empty.
500 There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.
503 The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body.
Response Body
registration.applicationId
[UUID]
The Id of the Application that this registration is for.

registration.authenticationToken
[String]
The authentication token that may be used in place of the User’s password when authenticating against this application represented by this registration.

registration.cleanSpeakId
[UUID]
This Id is used by FusionAuth when the User’s username for this registration is sent to CleanSpeak to be moderated (filtered and potentially sent to the approval queue). It is the content Id of the username inside CleanSpeak.

registration.data
[Object]
An object that can hold any information about the User for this registration that should be persisted.

registration.id
[UUID]
The Id of this registration.

registration.insertInstant
[Long]
The instant that this registration was created.

registration.lastLoginInstant
[Long]
The instant that the User last logged into the Application for this registration.

registration.preferredLanguages
[Array<String>]
An array of locale strings that give, in order, the User’s preferred languages for this registration. These are important for email templates and other localizable text. See Locales.

registration.roles
[Array<String>]
The list of roles that the User has for this registration.

registration.timezone
[String]
The User’s preferred timezone for this registration. The string will be in an IANA time zone format.

registration.tokens
[Map<String,String>]
DEPRECATED
A map that contains tokens returned from identity providers.

For example, if this user has authenticated using the Facebook Identity Provider, the Facebook access token will be available in this map, keyed by name Facebook. For an OpenID Connect Identity provider, or other generic providers, if a token is stored it will be keyed by the Identity Provider unique Id.

Removed In 1.28.0
The token returned and stored from the Identity Provider is now stored in the IdP link and is retrievable using the Identity Provider Link API.

registration.username
[String]
The username of the User for this Application only.

registration.usernameStatus
[String]
The current status of the username. This is used if you are moderating usernames via CleanSpeak. The possible values are:

ACTIVE - the username is active
PENDING - the username is pending approval/moderation
REJECTED - the username was rejected during moderation
If a username has been rejected, it is still possible to allow the User to update it and have the new one moderated again.

registration.verified
[Boolean]
This value indicates if this User’s registration has been verified.

Example Response JSON
{
"registration": {
"applicationId": "10000000-0000-0002-0000-000000000001",
"data": {
"displayName": "Johnny",
"favoriteSports": [
"Football",
"Basketball"
]
},
"id": "00000000-0000-0002-0000-000000000000",
"insertInstant": 1446064706250,
"lastLoginInstant": 1456064601291,
"preferredLanguages": [
"en",
"fr"
],
"roles": [
"user",
"community_helper"
],
"timezone": "America/Chicago",
"username": "johnny123",
"usernameStatus": "ACTIVE",
"verified": true,
"verifiedInstant": 1698772159415
}
}

@loc-nguyendinh

Thanks for the post! This is a bug, but is fixed in 1.48.3.

More details here: https://github.com/FusionAuth/fusionauth-issues/issues/2566

@david-gonzalez said in 403 on angular redirection to loging page:

Hi @dan, thank you for your prompt answer. I missed that part when looking at the doc.

I will explain what we are trying to do and maybe you can tell me if its possible or not.

We are trying to set up with fusionauth a centralised authentication and authorization service for our web application.
We have multiple client and for security / availability each instance of the application is hosted in its own server instance. What we would have like to do is to setup a single instance hosted by fusionauth on the cloud for higher availability and better SLA and manage each user's permission for each user on that single instance for easier support and management.

But what i understand with the documentation you provided, is that it is not doable, or am i missing / misunderstanding something ?

Thank you again for your help.
Ensuring compliance with appropriate industry standards and statutory safety regulations.

@zihaojustsimple it looks like this is from the React application making a call to your Spring backend. We would need more code to understand where you are pulling in user.

You could do this using our React SDK another great place to see this in action is our FusionAuth Example React SDK application.

If those examples don't get you the information you are looking for I would suggest trying out our TypeScript client.

When using our Login API you will see that there is a HTTP Only cookie available with the access_token which you will need to make the call to your backend. We recommend passing this into your backend so that you can then verify that this is a valid user using server side code within Spring.

If none of that works feel free to jump into our Slack community.
https://fusionauth.io/community

@alex-patterson I read that section in the documentation. Was just hoping there was a simple way to require a user to set up MFA on login.

h74frvvu1owb1.png

@anna Great idea! For this, the best path forward is to file a feature request in our GH issues repo with details about the use case. We take community votes on these issues as input when planning our roadmap.

I can say that right now this is not on our near term roadmap, but would love to learn more about what you are seeing.

In PHP with FusionAuth, you can pass an initial parameter through the OAuth source and have it returned on successful login. While there may not be a specific example tailored to your exact use case, you can include your parameter in the OAuth request URL like "?parmOne=Mark," and FusionAuth should be able to return it to you upon a successful login.

FusionAuth provides a flexible system for handling OAuth parameters, and you can adapt the PHP example you mentioned to suit your needs. For a beginner-friendly example, you can start with the basic PHP integration and customize it to include your desired parameters.