The only two grants that are relevant to an interactive flow are the authorization grant, and the implicit grant.

I don’t recommend you use the implicit grant at all, so that leaves only the authorization grant.

If the authorization grant is happening, response_type will be code.

If the authorization grant is occurring due to a device grant, the user_code variable will be set.

@maxim-kremenev,

Sorry to hear that you are still having problems.

But according to documentation, it is about to resend the email

I was a bit confused, there are two API calls that are related.

The first call should be PUT /api/user/verify-email?email={email}. The second should be POST /api/user/verify-email?verificationId={verificationId} takes the verificationId obtained in the first call and marks the user as email verified via API.

I spun up FusionAuth and was able to get this email to send by calling the API.

Let's see if we can retrace our steps to find out what may be happening. To start, this was the command I ran and the result.

curl --location --request PUT 'http://localhost:9011/api/user/verify-email?email=<my_email@my_email.com>' \ --header 'Authorization: <API KEY>' \ --header 'X-FusionAuth-TenantId: <TENANT_ID>'

should return

{ "verificationId": "SOME_REALLY_LONG_ALPHANUMERIC_STRING" }

status: 200

I find it interesting that you are getting a 200 OK, and no response body.

Have you verified that you have verify registration set up (toggled) on the Tenant and Application level (the application level is optional, depending on the behavior you want for your customers) as well as the ability to send a test email in the SMTP setting under the tenant?

if you have those three things configured, as well as an appropriately provisioned API key and correct tenant ID, the above cURL command has a high chance of working for you.

If this is still not working, any other recreate steps might be helpful in diagnosing.

Below are some over annotated screenshots that might help 🙂
tenant-orginal.png
application-original-orginal.png

I will let you know if I can think of anything else in the meantime.

Thanks,
Josh

@amar-sibia

Bummer.

Suggestions:

file a bug report with Azure about being able to control the frame header. file a feature request with FusionAuth: https://github.com/fusionauth/fusionauth-issues/issues if the community needs this feature, it'll be voted up and bubble up the priority list. don't run the login window in an iframe 🙂

@fred-fred said in Is there an example of how to authorize a user to an app and allow them to access after using the login API?:

May I ask, why do you have /API/Login if all it really does is authenticate but not authenticate and authorize like the Login pages?

I'm not sure I totally understand the premise of the question. I hear your frustration, however.

The Login API provides a JWT, which can be used for authorization. It seems like you are looking for configurable SSO which is, as I understand it, a different thing.

Our SSO implementation (like almost every other SSO implementation for web browsers) depends on cookies, which are not really something you can set with a backend API in a effective way (because the cookies have to be set by the component responding the browser, which the Login API will not be.) If there's an SSO implementation that is available via an API, please share that as we're always looking to improve.

When you use the Login API, you have complete custom control over every aspect of the UX. But with great power comes great responsibility 🙂 , and part of that responsibility is re-implementing SSO.

Ideally, you would be using the Oauth2 login and logout endpoints which would also give you SSO, and a lot of other features such as forgot password, passwordless, two-factor login, account lockout, federated logins, etc.

If you have a technical reason not to use OAuth - the Login API is available. Using the Login API means you will be coding all of the end-user workflows described above such as two-factor, forgot password, etc yourself.

Our Five Minute Guide Covers one of the most common OAuth Grants and workflows available.
https://fusionauth.io/docs/v1/tech/5-minute-setup-guide/#undefined

No. Neither. But it will revoke the SSO token.

https://fusionauth.io/docs/v1/tech/guides/single-sign-on#request-flow-diagrams

If managing your own session (not OAuth)

Documentation Link

If you are not using the FusionAuth SSO, then you will manage the user session and state in your application.

Within this self-managed context, the Logout API /api/logout is only useful if you are using the Login API within the context of a browser. In this case, the Logout API will return a response HTTP header to tell the browser to delete the cookies written by the Login API.

In other words, depending on your configuration/setup/specifics, there may be more work to do within your self-managed SSO to completely log the user out.

If not managing your own session (one example would be to follow OAuth)

Documentation Link

If you are following OAuth, then you will hit the endpoint provided in the above doc link (currently /oauth2/logout).

This logout endpoint provides a mechanism to invalidate the user’s session held by FusionAuth, this effectively logs the user out of FusionAuth.

The FusionAuth SSO enabled through an OAuth2 code grant handles the user session validation.

-However-

The Login API (/api/login) does not use FusionAuth SSO. In this scenario, the user session is managed in your own application (more customization possible, but likely more code work).

You'll need to separate out the hash and the salt on the Import API.

For example, the hash $2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy would be split out to the fields:

factor: 10
salt: N9qo8uLOickgx2ZMRZoMye
password: IjZAgcfl7p92ldGxad68LJZdL17lhWy

The Import API does not parse this value and separate it out for you. You need to do so.

Here is an example import script (in Ruby): https://github.com/FusionAuth/fusionauth-import-scripts/blob/master/auth0/import.rb#L47

Hi @trevorr,

I can't say that we have an out-of-box solution for you on this directly. If you would like to submit a feature request fully outlining your use case, we could have our dev team review it.

I have a couple of other thoughts:

we want to send email from our marketing platform for consistent tracking

Remember that you have the ability to augment the user object with custom data (User API -- user.data field). Some of this data could be a tracking code that links back to your marketing platform, for instance.

we want a consistent look and feel in the password setting UI (simulating Material UI in a FA theme seems infeasible),

FreeMarker templating does accept HTML and other modern inputs to allow you to custom craft a landing page that meets your brand requirements (You can check out some examples of exactly this, here). Anecdotally, I have heard of some customers that use services such as MailChimp/ContantContact/Drip to create templates and then import them into FreeMarker. It is outside of my domain expertise, but it seems this is done often enough.

c) FusionAuth doesn't seem to have a way to send the user into our app after they set a password.

This is possible but would require some additional javascript code. See Here

Webhooks are also a powerful tool within FusionAuth to notify when certain other user actions occur. API documentation here

If anything else comes to mind, I will post back here! I hope this helps!

Thanks,
Josh

To add on to what @joshua was saying, we are pretty careful about what we make available in our lambda because performance is really important and we don't want to start loading a bunch of data that isn't required. That said, I understand the current lambda implementation isn't meeting your needs, however.

Two issues you may want to review, comment on and vote up:

https://github.com/FusionAuth/fusionauth-issues/issues/229

https://github.com/fusionauth/fusionauth-issues/issues/267

Both of these issues address your desired functionality in different ways.

Internal Note: tracking via https://github.com/FusionAuth/fusionauth-issues/issues/1231

Hi @joshua , thanks for your response.

Is the code that you are sending related to MFA? Or some other business logic? If MFA related, there may be more options that we can explore.

My use-case is related to our business logic, our app is only available in certain countries; thus we require users to validate they're in one of those countries via a code sent to their phones. I've read the docs about the Form API but I don't quite see how would it solve this issue (and, as you said, would negate the benefits of advanced forms). The other option would be just to validate the phone outside FusionAuth (like we're doing right now), but I would like to migrate all the registration-related steps into FusionAuth.

Yes. As of 1.27, you can use a verification strategy of FormField. This is configured on the tenant: https://fusionauth.io/docs/v1/tech/apis/tenants/

You then provide the one time code in the oneTimeCode request body parameter. More about this in the email verification docs: https://fusionauth.io/docs/v1/tech/apis/users/#verify-a-users-email

Note that this feature only works with email gating at the current time, which is a reactor feature requiring a paid license.

@naughtly-keller! You are right! Good spot!

@alessiocata I would recommend you peruse the entire guide that @naughtly-keller links to. It goes through many different situations in which Passwordless can be applied and used within FusionAuth. Pick the one that is best suited for your business needs.

Thanks,
Josh

Setting the "Allowed origins" in the Application settings did the trick.

To clarify my current MFA delivery setup (v1.25), I have it configured with "delivery": "None" and this enables the Authenticator and backup codes via the Twilio integration.

Will this keep working? Or do I have to update each user and enable the "sms" method? Is it even possible to enable the "sms" method without having a code that was sent to the mobilePhone of the user?

Unfortunately in this case, I believe this is the current expected behavior for the MFA workflow.

If you have a specific use case that necessitates changes to this, please feel free to log a feature request with all the details and any other considerations 🙂 👍

https://github.com/FusionAuth/fusionauth-issues/issues/1234

I end up using a docker image of mailcatcher.

I use the default docker-compose.yml, but use this docker-compose.override.yml:

version: '3' services: mailcatcher: image: yappabe/mailcatcher ports: - "1025:1025" - "1080:1080" networks: - mailcatcher search: image: docker.elastic.co/elasticsearch/elasticsearch:7.8.1 environment: cluster.name: fusionauth bootstrap.memory_lock: "true" discovery.type: single-node FUSIONAUTH_SEARCH_MEMORY: ${FUSIONAUTH_SEARCH_MEMORY} ES_JAVA_OPTS: ${ES_JAVA_OPTS} # Un-comment to access the search service directly # ports: # - 9200:9200 # - 9300:9300 networks: - search restart: unless-stopped ulimits: memlock: soft: -1 hard: -1 volumes: - es_data:/usr/share/elasticsearch/data fusionauth: depends_on: - search - mailcatcher environment: SEARCH_SERVERS: http://search:9200 SEARCH_TYPE: elasticsearch networks: - mailcatcher - search networks: search: driver: bridge mailcatcher: driver: bridge volumes: es_data:

Then I configure the SMTP settings to use the hostname mailcatcher and the port 1025. I can then send email and view it in the mailcatcher interface, at localhost:1080.

Here's the relevant dockerfile: https://github.com/yappabe/docker-mailcatcher/blob/master/Dockerfile

Here's more about mailcatcher: https://mailcatcher.me/