@ralph Thanks for following up and sharing!

@mark-robustelli thanks Mark.

All domains will be sub-domains of the main domain name, but for this staging system, we are using 2026.domain.com and 2026-tenant1.domain.com, 2026-tenant2 etc.

Logins work successfully without the idphint on a per tenant basis but we want all tenants to use the common master tenant (via SSO) as the login, because many users will be members across multiple tenants and their data can be common across tenants.

The auth server uses auth.domain.com

We have the master tenant and sub tenants in FusionAuth. We have the master application and sub-tenant applications for each tenant.
A tenant application has an authorized redirect like 2026-tenant1.domain.com/callback and currently no request origin (I have tried adding this for sub-tenant and master tenant together). I've tried adding the sub-tenants as authorized origins on the master tenant.

There's nothing extra configured on the FusionAuth tenants.

Under settings, Identity Providers, we have an OIDC provider pointing back to the master app in the master tenant. We do see the button to login with master tenant on a sub-tenant (if no idphint is set).

All sub-tenant applications are enabled for this provider (with create reg), I also have the sub-tenants added in this IP and have tried without. Managed domains is blank. Not using the POST method.

Auth endpoints have been manually set (because FusionAuth couldn't self-discover?!) like so:
https://auth.domain.com/oauth2/authorize,
https://auth.domain.com/oauth2/token,
https://auth.domain.com/oauth2/userinfo

There's no groups configured.

Hosting wise, FusionAuth is a Docker container on the same server with the main app and sub-tenants behind a Traefik 2 proxy which is also behind Cloudflare and each site has its own LetsEncrypt SSL cert via Traefik.

Direct login to the master tenant is successful but not via a sub-tenant.

Grok suggests it's a CORS issue. My filter was not enabled. I also tried enabled (current) and allowed all methods with (and without) wildcard origins.

As mentioned, the login is recorded on FusionAuth, it just seems to fail on the callback process via master..

The master login URL when called via a sub-tenant shows the master tenant as the callback URL. I've tried adding the sub-tenant callback as authorised in the master tenant.

I think that's everything..

I think the way I'd approach this is:

import all users into FusionAuth

At cutover time:

look at local database to see which password hashes had changed pull the user data from FusionAuth for each of these users delete the user re-import the user with the new password hash and the FusionAuth data, maintaining the same userId (if you provide the UUID, we'll use that)

I get that is an additional complexity, but hopefully that helps.

This is totally possible.

You want to start by understanding FusionAuth passkey setup and the normal flow.

Then, in your application, probably using one of the client libraries, you want to do the following for a user:

see if a user has a passkey set up, using the "retrieve a passkey" API. If this returns 0 passkeys, show the prompt. for the prompt, you have two options: use the API/client library to start the passkey registration process from within your application directly send them to the user management page to add a passkey (requires a paid license)

The right way to do the latter depends on your application needs (are you okay with a redirect) and whether or not you have at least a starter license.

For reporting on the number of users that have set up passkeys, unfortunately you have to query all your users and then pull the passkey data individually. There's no way to use the elasticsearch syntax to do the query as of yet. There's an open github issue to add that functionality.

@james-hudson You may want to check out this blog post. Hopefully that can help.

@scottw Hopefully, I can get a little time over the next couple of days and see if I can duplicate it. I will let you know if I find anything. Anyone else seeing his behavior?

@rgros Do you have Debug enabled?

Screenshot 2026-02-18 at 10.43.14 AM.png

Then you should check your Event Log.

Screenshot 2026-02-18 at 10.44.20 AM.png

Let us know what you find.

@david-cuen Thanks for your patience and dedication to seeing this through. It would help a ton if you could find something reproducible. Let me know what you find and I can continue to try it on this end.