This can be accomplished through using lambdas. You will want to create a lambda of type JWT Populate. The code will look something like this.

function populate(jwt, user, registration) { var urlToFetch = "http://localhost:9012/api/entity/grant/search?userId=" + user.id; var response = fetch(urlToFetch, { method: "GET", headers: { "Content-Type" : "application/json", "Authorization" : "this_really_should_be_a_long_random_alphanumeric_value_but_this_still_works" } }); if (response.status === 200) { jwt.entityInfo = JSON.parse(response.body); } else { console.error("Error: " + response.status + " " + response.statusText); } }

The go to your application in the admin UI and under the JWT tab, under the Lambda settings section assign that lambda to the 'Access Token populate lambda'

A few things to keep in mind:

Please note the use of port 9012 when calling the API from the lambda. From the documentation "Use port 9012, or the configured value for fusionauth-app.http-local.port, whenever making a FusionAuth API call in a lambda. Doing so minimizes network traffic contention and improves performance." As of this post, you will need the Essentials license for the HTTP Lambda Connect feature.

Here's a more full featured implementation:

import jwt from '@tsndr/cloudflare-worker-jwt'; import dev_jwks from './jwks/dev.json'; function authenticate(handler) { return async function (request, response) { let headers = request.headers; if (!headers.has("Authorization")) { return json_error(401, "No Auth header present"); } let auth_header = headers.get("Authorization"); if (auth_header.indexOf("Bearer ") !== 0) { return json_error(403, "Bad auth header"); } let token = auth_header.slice(7); let verified = await jwt.verify(token, dev_jwks.keys[0], {algorithm: "RS256"}); if (!verified) { return json_error(403, "Bad auth token"); } try { token = jwt.decode(token); } catch (e) { return json_error(403, "Unable to decode token"); } let { header: meta, payload } = token; // TODO: inspect the payload of the jwt return await handler(request, response); }; }

where json_error is an error handler function outside the scope of this example and the JWKS file is downloaded and put into './jwks/dev.json' and the key is known to exist in the first entry in that array.

A more sophisticated version would examine the key id from the token header and find the corresponding public key in the the JWKS array.

The User Support Guide outlines actions customer support reps will need to take w/r/t customers and users managed by FusionAuth.

Okay, so the docs also describe the requirement for testing the applicationId claim:

https://fusionauth.io/docs/v1/tech/core-concepts/authentication-authorization#:~:text=Authorization and Securing Your Application

Unfortunately the application feature Registration->Self-service registration doesn't work for token requests. And OAuth->Require registration doesn't work for password grant type.

@alexiussamson83 With a single FusionAuth Application you can use this with multiple SDK's or API's.

https://fusionauth.io/docs/v1/tech/client-libraries/

I rolled back and installed an elastisearch container. Added the SEARCH_TYPE in the fusionauth deployment and mapped a service to the same RDS DB and it stood up without an issue. Something screwy in the way Fusionauth is connecting to either Postgre or MySQL.

I'm going to have to talk to sales as I want to enable the features temporarily to use it as a POC. Also so I can justify the cost per month for actual support beyond forums.

Thank you for your time.

@mark-robustelli - Apologies for the incorrect subject line. I am trying to redirect once user is setup password from the "Update your password" page. Basically i am trying to redirect to application login page once user is setup their password.

Please find attached password setup page which i need to add redirect URL once password setup is completed.

Screenshot 2023-08-30 at 10.21.33 AM.png

Unfortunately, this lambda will only fire on user registration or complete registration event, not on account page updates.

If you are looking to control how a user can update their profile, another option would be to use our events and webhooks (making them transactional - All webhooks must succeed) to do additional data processing to determine if a user update can succeed.

See the list of events here: https://fusionauth.io/docs/v1/tech/events-webhooks/events/

user.update or user.registration.update might be good events to use.

Currently FusionAuth does not provide additional logging or events for a failed 2FA login.

There are two reasons that a 2FA code would be considered invalid (assuming the code was valid at one point in time):

Expiration. You can control the duration of these codes in the Advanced tab of the edit tenant page by adjusting the external identifier duration for Two-Factor login Another code requested. A user is only allowed one active 2FA code at a time, so if there is a situation where another 2FA code is requested, the other code would be invalidated.

It'd be good to see if you can narrow down the situation where the invalid code method is received to one of those, which may help troubleshoot the root cause.

We have documentation that describes how you can monitor FusionAuth.

Each of the logs that you mention has an API exposed that can be used to consume FusionAuth data into an external system.

At this time, you'll need to write scripts, using the client libraries, to scrape and ingest these logs.

If you are looking to get webhooks into a system, we have an example AWS lambda which pushes webhook events to S3.

@muhammadfatihmaulana434 Ah, if you run both services in docker, you need to use their docker hostnames if they are all in the same network (perhaps using docker-compose). Or you can use host.docker.internal to refer to the host machine, which has ports mapped to each docker image.

https://docs.docker.com/desktop/networking/ has more details.

Alternatively, run the Laravel application outside of docker.

@alickabrook1
I was not setting origin URL in mobile app.

I was setting it in fusionauth config.

Shared screenshot in https://github.com/FusionAuth/fusionauth-issues/issues/1443

Hi Martin, we updated the feature matrix here: https://fusionauth.io/pricing?step=plan&hosting=self-hosting to make it clear that application specific MFA configuration is an enterprise only feature.

Cheers!

Yes. There are two ways to accomplish this.

If you know the factor ahead of time (it is recorded in a database), then you can set it on import. Use the Import Users API. (You can also use the Create User API if you are creating one user at a time.) With the Import User API, set the factor for each user; they don't have to be the same across all users.

If you don't know the factor ahead of time, you need to create a plugin. Here's a sample plugin.

In the encrypt method, which has this signature: public String encrypt(String password, String salt, int factor), you can ignore the provided factor and use the algorithm you mention to calculate it. You are passed the plaintext password and can examine it for length, characters, etc.

Test and install the custom password hashing plugin into your FusionAuth instance as documented. (If you are running in FusionAuth Cloud, you'll need to open a support ticket with the jar file.)

When importing the user, the factor won't matter, but make sure to set the encryptionScheme to your custom password hashing plugin.

After importing, configure your tenant to rehash users' passwords on login to a more standard factor and hashing scheme. Learn more about that here.

@mark-shapiro Thanks for sharing with the community.

So, to call the user registration form, one just needs to:

Remove any calls to prefetchConfiguration() Pass every needed URL (authorize, token and logout endpoints) to a serviceConfiguration object Call the authorize() method but use the custom /oauth2/register endpoint
Here's a sample code: // Configuring FusionAuth const fusionAuthConfig = { issuer: "your.fusionauth.url", clientId: "Your application's Client Id", redirectUrl: "com.your.app://oauthredirect", scopes: ["openid", "offline_access"], serviceConfiguration: { authorizationEndpoint: "https://your.fusionauth.url/oauth2/authorize", userRegisterEndpoint: "https://your.fusionauth.url/oauth2/register", // This will be used down below tokenEndpoint: "https://your.fusionauth.url/oauth2/token", endSessionEndpoint: "https://your.fusionauth.url/oauth2/logout", }, }; // And then, in your component, replace the URL in authorizationEndpoint // with the one in userRegisterEndpoint and call authorize() const config = {...fusionAuthConfig, ...{ serviceConfiguration: { ...fusionAuthConfig.serviceConfiguration, authorizationEndpoint: fusionAuthConfig.serviceConfiguration.userRegisterEndpoint, }, }}; const authState = await authorize(config);

More detail can be found here: https://github.com/FusionAuth/fusionauth-issues/issues/2435

@erocihihape , can you please provide me the SMTP config you have used and any Additional properties you have configured for fusionauth and smtp.office365.com integration

I'm not exactly sure what the question is here. What are you trying to accomplish or looking for?

@mark-robustelli Thank you Mark..! I will keep in mind.

@joshua said in Fusion auth is creating 2 sessions when a single user logs in? Is this correct?:

Depending on how you are using FusionAuth, this is normal. One of the sessions is going to be the SSO session. And the other is going to be an Application level refresh token. There could be possibly other refresh tokens present as well, depending on your use case and integration.

Thank you for your response. However I have another question, backend is calling logout api of fusion auth by passing refresh token, now it only deletes 1 session. The other session remains and on client side user is logged in on fusion auth. Now to logout from client side I am redirecting user to fusion auth logout url to delete that remaining session. Is this intentional, if yes, then is there some other alternative?