Hi @lambert-torres

Can you please provide some context as to what you are looking to achieve?

Are you storing this data on the user.data.* fields? How are you storing this data/arrays programmatically?

Thanks,
Josh

@markdoner27 This is a far-reaching question. Please feel free to post your question specifically as it relates to FusionAuth and we may be able to provide additional feedback.

-Josh

@richb201 Heya, you need to start or install FusionAuth. It's a program like MS Word or your web browser. If you haven't used it in a while, it might be stopped.

How you start it depends on how you installed it. https://fusionauth.io/docs/v1/tech/installation-guide/ has some of the methods.

@llorach-pablo It's been a while since I used .NET Core 5, but are you using a symmetric (HMAC) or asymmetric (RSA, ECC) key to sign your tokens?

The default is HMAC, but for .NET Core, I think you have to use asymmetric keys.

Here's information on creating keys: https://fusionauth.io/docs/v1/tech/core-concepts/key-master

Here's information on setting the signing key: https://fusionauth.io/docs/v1/tech/core-concepts/applications#jwt

@pclark it's macOS

@lambert-torres

Hiya,

There is no way to update a user Id after the account has been created. However, you can always specify a valid UUID when creating a user (and, indeed, most other FusionAuth resources).

Simply provide a valid UUID on the path of the POST request.

https://fusionauth.io/docs/v1/tech/apis/users#create-a-user has more.

Based on what you shared, that should work. Let me know if there's nuance I missed.

Thanks for using FusionAuth!

Dan

@orrett said in Cannot logout using the python client and logout api.:

I am using the python client to logout a user. Unfortunately I am getting a nondescript error from the server. Here is my code:

data = { 'global': 'False', 'refreshToken': req_data['refresh_token'] } logout = current_app.faclient.logout(data) if logout.was_successful(): return cr.custom_response({logout.success_response}, 200) else: print(logout.error_response) return cr.custom_response({'error': 'there was an error'}, 404)

The error I get in the console is <Response [500]>

On the FusionAuth server, I see the following stacktrace:

Aug 04, 2020 7:34:50.850 PM ERROR io.fusionauth.app.primeframework.error.ExceptionExceptionHandler - An unhandled exception was thrown org.primeframework.mvc.parameter.convert.ConverterStateException: The primitive converter doesn't support String[] to Object conversion. at org.primeframework.mvc.parameter.convert.converters.AbstractPrimitiveConverter.stringsToObject(AbstractPrimitiveConverter.java:59) at org.primeframework.mvc.parameter.convert.AbstractGlobalConverter.convertFromStrings(AbstractGlobalConverter.java:89) at org.primeframework.mvc.parameter.el.Accessor.convert(Accessor.java:152) at org.primeframework.mvc.parameter.el.MemberAccessor.set(MemberAccessor.java:133) at org.primeframework.mvc.parameter.el.Accessor.set(Accessor.java:90) at org.primeframework.mvc.parameter.el.Expression.setCurrentValue(Expression.java:93) at org.primeframework.mvc.parameter.el.DefaultExpressionEvaluator.setValue(DefaultExpressionEvaluator.java:132) at org.primeframework.mvc.parameter.DefaultParameterHandler.setValues(DefaultParameterHandler.java:205) at org.primeframework.mvc.parameter.DefaultParameterHandler.handle(DefaultParameterHandler.java:121) at org.primeframework.mvc.parameter.DefaultParameterWorkflow.perform(DefaultParameterWorkflow.java:54) at org.primeframework.mvc.workflow.SubWorkflowChain.continueWorkflow(SubWorkflowChain.java:51) at org.primeframework.mvc.parameter.DefaultURIParameterWorkflow.perform(DefaultURIParameterWorkflow.java:102) at org.primeframework.mvc.workflow.SubWorkflowChain.continueWorkflow(SubWorkflowChain.java:51) at org.primeframework.mvc.scope.DefaultScopeRetrievalWorkflow.perform(DefaultScopeRetrievalWorkflow.java:58) at org.primeframework.mvc.workflow.SubWorkflowChain.continueWorkflow(SubWorkflowChain.java:51) at org.primeframework.mvc.message.DefaultMessageWorkflow.perform(DefaultMessageWorkflow.java:45) at org.primeframework.mvc.workflow.SubWorkflowChain.continueWorkflow(SubWorkflowChain.java:51) at io.fusionauth.app.primeframework.FrontEndTenantWorkflow.perform(FrontEndTenantWorkflow.java:71) at org.primeframework.mvc.workflow.SubWorkflowChain.continueWorkflow(SubWorkflowChain.java:51) at org.primeframework.mvc.action.DefaultActionMappingWorkflow.perform(DefaultActionMappingWorkflow.java:126) at org.primeframework.mvc.workflow.SubWorkflowChain.continueWorkflow(SubWorkflowChain.java:51) at org.primeframework.mvc.workflow.StaticResourceWorkflow.perform(StaticResourceWorkflow.java:97) at org.primeframework.mvc.workflow.SubWorkflowChain.continueWorkflow(SubWorkflowChain.java:51) at org.primeframework.mvc.parameter.RequestBodyWorkflow.perform(RequestBodyWorkflow.java:89) at org.primeframework.mvc.workflow.SubWorkflowChain.continueWorkflow(SubWorkflowChain.java:51) at org.primeframework.mvc.security.DefaultSavedRequestWorkflow.perform(DefaultSavedRequestWorkflow.java:57) at org.primeframework.mvc.workflow.SubWorkflowChain.continueWorkflow(SubWorkflowChain.java:51) at io.fusionauth.app.primeframework.CORSFilter.handleNonCORS(CORSFilter.java:291) at io.fusionauth.app.primeframework.CORSFilter.doFilter(CORSFilter.java:252) at io.fusionauth.app.primeframework.CORSRequestWorkflow.perform(CORSRequestWorkflow.java:48) at org.primeframework.mvc.workflow.SubWorkflowChain.continueWorkflow(SubWorkflowChain.java:51) at io.fusionauth.app.primeframework.FusionAuthMVCWorkflow.perform(FusionAuthMVCWorkflow.java:88) at org.primeframework.mvc.workflow.DefaultWorkflowChain.continueWorkflow(DefaultWorkflowChain.java:44) at org.primeframework.mvc.servlet.FilterWorkflowChain.continueWorkflow(FilterWorkflowChain.java:50) at org.primeframework.mvc.servlet.PrimeFilter.doFilter(PrimeFilter.java:82) at com.inversoft.maintenance.servlet.MaintenanceModePrimeFilter.doFilter(MaintenanceModePrimeFilter.java:59) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at com.inversoft.servlet.UTF8Filter.doFilter(UTF8Filter.java:27) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:199) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:543) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:81) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343) at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:615) at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65) at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:818) at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1623) at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1130) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:630) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.base/java.lang.Thread.run(Thread.java:832)

I am using version 1.18.5

thanks my issue has been fixed.

@stacey Great. Did you end up getting it working?

@jose-0 Hiya,

I'm not sure I totally understand your use case, but this should be doable using the APIs and some code. But it isn't going to be available out of the box.

If I were to do this, I'd build a page which let a user supply two email addresses and specify which one should be primary.

Then I'd write some code to send a random number to each email address and have them enter the number on that same page.

If the codes were correctly entered, I'd presume that the user was the same (all they really proved is that they had access to each of the email inboxes, though. If you wanted more assurance, you could use step up auth). Then you can use the User API to:

update the primary account with any data that should be moved. I'd definitely move the secondary email (perhaps in an array on the user.data field). They won't be able to use this email address to log in any more, but it still might be useful for your support staff or to display in your UX lock the secondary account so it is not usable any more.

None of this is out of the box with FusionAuth, but building on the APIs it should absolutely be possible.

Hope that helps, thanks for using FusionAuth!

@lambert-torres

Hiya, there is no API I know of that will remove a user from all groups, but you can certainly chain APIs. The way I'd do it would be to retrieve the user using the User API, iterate all user.memberships and get the groupId from each one. Then I'd use the Group API to remove the user from each group, using DELETE against /api/group/member?groupId={groupId}&userId={userId}

Hope that helps, thanks for using FusionAuth!

@joshua After digging deeper in the code it looks like this is actually a shared configuration file between the frontend and backend (which was a little confusing). But it doesn't look like the client actually uses the secrets or apiKey which is what I didn't think was safe. So I think I am good for now. Thank you for following up with me.

I'm understanding the Node JS side more ... I may be able to replicate this behavior in Spring Boot. If so I'll share my findings and maybe you guys can add this to your examples for future users.

@lsmith

This seems about right. Will review.

Thanks,
Josh

@emudojo Sorry for the delay

Were you able to figure this out?

Our documentation covers some nuances to the put/patch for this endpoint which you may be experiencing here.

https://fusionauth.io/docs/v1/tech/apis/users#update-a-user

Thanks,
Josh

@evgeniya-gabrikova Thanks so much for coming back and sharing your solution!

Avoids the "Wisdom of the Ancients" problem: https://xkcd.com/979/

Hi dan,

Thanks for the reply, I ended up storing permissions in the user.data field.

I hope you'd consider adding the "entity grants to permissions" of the client credential flow in the authorization code flow in a future release, entity fits many needs and may ease integration.

We appreciate FusionAuth is very flexible, you're doing a great job 👏

Future Viewers Note:

This can be obtained via the User API

https://fusionauth.io/docs/v1/tech/apis/users#retrieve-a-user

You can view the user's registrations in the response:

user.registrations [Array]
The list of registrations for the User. This will include registrations for inactive applications.

The tenant is using the "Default signing key (HS256)" for the access token.

@andrey-dzhezhora

Hmmm. What does the login API return as a status code. My guess, from reading the docs, is that it returns a 212, as specified here: https://fusionauth.io/docs/v1/tech/apis/login#authenticate-a-user

This is still a kind of success, and if you are using the Login API, you are expected to consume the response codes and make appropriate limitations based on that.

Does that make sense?

If, on the other hand, you are getting a 200 for this user, that seems like a bug. Or at least something is going on that I don't understand.

@david-billings

Does FA remove users once they've been removed from LDAP?

If you use the LDAP as the source of truth, the users won't be able to login, but they won't be removed.

So, consider this scenario (no migration, just always going back to LDAP):

User A logs in successfully through a tenant configured with an LDAP Connector. User A has an account in the LDAP server. FusionAuth checks with the LDAP connector, passing the credentials. The LDAP server says "yup, User A is okay." FusionAuth creates a user. Time passes. User A is removed from the LDAP server. User A tries to login. FusionAuth checks with the LDAP connector, passing the credentials. The LDAP server says "User A is not found" FusionAuth denies the login.

But the user still exists.

Is there anyway to sync this and sync the users without each user having to login?

You want to sync the users between LDAP and FusionAuth without the user having to login? Is this a one way sync?

You could do a bulk migration using the Import User API if you have access to the LDAP database and can provide the password hashes.

That is the only option that comes to mind.

Anyone seen this issue. I am still having this issue.