Does this happen regularly, or intermittently? It looks like some kind of SSL issue from the stacktrace, but I'm afraid I don't have any experience with this configuration.

Another troubleshooting approach would be removing components to see if that changed the behavior.

Or you could also search for interactions between Hikari (the java connection pooling system FusionAuth uses) and haproxy.

Sorry I don't have a better answer for you. Please let us know what you end up finding out!

Can you please provide more details?

What you are trying to do? A step by step explanation would be really helpful for anyone trying to understand what problem you ran into.

Thanks,
Dan

@robertom

I'm not quite sure how to answer your question without more details. If you want to use FusionAuth as an external directory, you could encrypt sensitive data and store it on the user or registration objects. While there is built in support for managing keys you'd have to build the actual encryption logic yourself; you can't mark a user field to be 'extra encrypted' in FusionAuth at this time.

That might be an interesting feature; feel free to file a feature request with more details.

Two ideas:

Does it help to specify the key id when creating your test SymmetricSecurityKey? var key = new SymmetricSecurityKey(Encoding.ASCII.GetBytes( "My secret from application config" ) ) { KeyId = "Your Key Id" }; You don't specify which algorithm you're using to sign your tokens. If you're using SymmetricSecurityKey, ensure you're using an symmetric algorithm to sign your tokens.

I'm not sure what is going on, but my guess is that the cookies are shared locally (cookies are shared across ports), which is why things are working.

If you are trying to pass information from when someone logs in to after they are logged in, through the oauth flow, you should look at the state parameter. There's some information on doing that here: https://fusionauth.io/community/forum/topic/165/taking-a-user-directly-to-the-registration-page?_=1610507951768 but I'm not sure how it integrates with whatever library you are using. I'd consult the docs for that lib.

re: #1, please see my answer here: https://fusionauth.io/community/forum/topic/12/can-i-configure-the-inactivity-timeout-of-the-fusionauth-session-cookie?_=1610490171675

re: #2 I forwarded your message on to the team and someone should be reaching out about support options.

Thanks!

Ah, great. Yes, if you are running both the database and FusionAuth, you need more memory. If you are running elasticsearch too, you'll need even more.

@tony

Glad you were able to figure it out. I'm not aware of any other way to access the identity provider id from the response, but that does seem to solve your problem, correct?

Please feel free to file a feature request more clearly outlining your use case and proposed ideal solution.

It looks like the type of audiences is a set of strings, so I wouldn't expect any complex elements.

The docs say that this field is:

[a] list of the audiences for this SAML response. By default, the issuer or audience from the form are used.

This is not super clear to me, so I filed a PR against the docs to make it clearer: https://github.com/FusionAuth/fusionauth-site/pull/376

This looks to be a bug. Tracking here: https://github.com/FusionAuth/fusionauth-issues/issues/1067

Thanks for letting us know.

Hard to know exactly what's going on.

I would try creating another tenant and seeing if the same SMTP settings fail. Then I'd try standing up a version with the very latest FusionAuth version and seeing if you see the same behavior.

Also, do you have the same tenant smtp settings? That is under the "advanced" tab, then "smtp settings".

@dan

Thanks for the reply. It works

How much memory are you giving to the java process?

You can also switch to the database search engine and see if removing ES resolves the issue. At that point it might be a resource issue.

https://fusionauth.io/docs/v1/tech/tutorials/switch-search-engines/ has instructions on how to change these.

For anyone interested I got this running by one installing docker-compose from the actual docker tutorial on how to do it, and then giving docker permission to run commands as root. There is a tutorial on how to do it on. On top of those I moved it to a server with 2gb of ram, as I noticed a few out of memory errors when it was trying to start up.
https://docs.docker.com/engine/install/linux-postinstall/