Hiya,

I'm not sure, haven't done much with k8s. From a quick google, it looks like you might use helm upgrade?

https://helm.sh/docs/helm/helm_upgrade/

For exporting changes, it depends on how you make the changes. There's a community supported terraform module, but it doesn't cover all the apis (PRs welcome!).

You could also script all your changes using the API and apply those scripts to different environments. We mostly see folks writing migration scripts that call the APIs. These are very similar to database migration scripts except they make REST calls instead of SQL. The scripts are run during upgrades of their app. (If you are using an app like rails, you could even leverage the existing migration framework and a client library.)

Kickstart works well for dev envts and CI, but doesn't handle changes (it assumes there is no data in fusionauth and won't run if it sees any).

Moved to q&a section.

Hmmm. I'm no gcloud expert. But here's where I'd start looking.

What version of FusionAuth are you running? Can you connect to the mysql database in gcloud directly? Are you seeing any errors in the FusionAuth log files? Can you connect to where FusionAuth is running and try to connect to the database directly? Is the issue the connection or that FusionAuth isn't running as a privileged user? If the latter is the case, silent mode might help. You can run the table create statements directly against your database and FusionAuth will notice that after starting up.

This looks like a bug. Can you file an issue here: https://github.com/fusionauth/fusionauth-issues/issues

With your browser details, version of FusionAuth, console messages (if any) and any replication steps?

Thanks for using FusionAuth!

If you want to skip calling FusionAuth for each of these validation events, you can validate the JWT on your end without a network call.

If you configure a key pair (public + private) to sign your JWT, then the public key will be available in the JWKS. Many libraries exist that will validate JWTs using JWKS.

https://fusionauth.io/docs/v1/tech/oauth/endpoints/#openid-configuration
https://fusionauth.io/docs/v1/tech/oauth/endpoints/#json-web-key-set-jwks

I'll also add, GitHub is not OpenID Connect compliant and may or may not work great.

It only "works" because of the documented configuration which allows us to work around their deficiency.

There is an open feature for Login with GitHub.
https://github.com/FusionAuth/fusionauth-issues/issues/33

The most ideal scenario is for GitHub to offer an OpenID Connect compliant login option so that standards based libraries and products like FusionAuth can properly support them without building one off implementations to adjust to their flavor.

Not sure if this helps, as we don't currently use different tenants at this point in time, but we do for sure enforce sending the tenant id to each call:

When you setup the OpenIdConnectOptions ---

private const string TenantIdParameterName = "tenantId"; ... options.Events.OnRedirectToIdentityProvider = context => { /* Fusion auth has the option for multiple tenants - when multiple tenants enabled, we have to ensure we hit the right one for user auth. */ context.ProtocolMessage.SetParameter(TenantIdParameterName, authSettings.TenantId.ToString()); } options.Events.OnRedirectToIdentityProviderForSignOut = context => { context.ProtocolMessage.ClientId = authSettings.ClientId.ToString(); context.ProtocolMessage.SetParameter(TenantIdParameterName, authSettings.TenantId.ToString()); return Task.CompletedTask; };

Not sure if that helps you - you will have to look at the current HttpContext to decide what you want to do.

Have you checked out this documentation?

https://fusionauth.io/docs/v1/tech/themes/

That should help you customize your theme.

Moving to the q&a section.

@dan I'll go back to the client and see if PKCE can be disabled, but I'm not getting my hopes up…

For reference, the GitHub issue can be found here: https://github.com/FusionAuth/fusionauth-issues/issues/968

Hmmm.

You didn't specify if you were using mysql or postgresql. That has an impact on your options.

You could try increasing the size of the connection pool after the restart; new connections would succeed. Not sure if the connection pool FusionAuth uses is smart enough to reap the failed connections, but might be worth exploring.

It looks like hikari (the connection pool) does support auto reconnect after database failure, but only at a certain version of the driver and with certain socket connection settings: https://github.com/brettwooldridge/HikariCP/issues/1056

You can control the socket connection setting with the DATABASE_CONNECTION_TIMEOUT env var. And I verified that the version of the PG library is higher than that referenced in the github issue.

Were there any other logs available?

If you want to use the breached password detection feature, then that check will be applied for any new account registrations.

You could always disable the breached password detection feature.

Sorry, I don't have a better answer for you.

In an ideal import scenario, we only have the password hash. This means we can’t validate it during import because we don’t know what the plain text version of the password is.

At login time, you have an option to re-validate the password to see if it meets the current validation rules. If you enable this rule, then the user will be forced to change their password.

If you don’t enable this rule, nothing will happen and they can continue to use this password. The next time they attempt to change their password, it will be validated against the current validation rules.

In Tenants > Edit > Password > Password settings you’ll see "Re-validate on login". This toggle will force user’s to change their password during login if it does not meet the validation settings.

Hey Eddie,

This doesn't appear to be a question about FusionAuth. We try to keep the forum on topic.

Thanks,
Dan

Hiya,

FusionAuth is only supported on mysql and postgresql. People have made it work on mariadb, but I think it'd be a large effort to port it to a nosql database like mongodb. There are no plans on our side to do so.

The system uses mybatis and I don't see any support for mongo at the mybatis website: https://mybatis.org/mybatis-3/

So, I'd say it is far beyond "extra tweaking" to make FusionAuth work with mongo.

No, this isn't currently possible.

I think that would fall into the threat detection bucket of features we are planning. Feel free to add any notes, comments or suggestions here: https://github.com/FusionAuth/fusionauth-issues/issues/905

It sounds like citibank is acting as the authorization server in this scenario.

You could look through the example apps we provide and pick the language you use. Then wherever we mention FusionAuth, you could instead slot in the citibank information.

If they support OIDC or SAML, you could also have FusionAuth delegate auth to them using by configuring citibank as an identity provider. A quick scan of the docs indicates they don't support those standards, though.

so my users can login

FusionAuth would be helpful in providing user management to your application and your users, outside of any interactions with citibank.

I recommend going through the 5 minute setup guide and kicking the tires yourself to get an understanding of what FusionAuth can do.

Cheers!

This data is exposed in version 1.20.1.