Topics tagged with customization

Updates and custom themes

dan — Invalid Date

@billyudi We are working on a update to the upgrade guide which will discuss how to map the new theme files and changes.

You can follow along with it here:

https://github.com/FusionAuth/fusionauth-site/pull/2166

I get your larger question though, which is, if I customize my theme, and then I upgrade from 1.45 to 1.46 and 1.46 introduces a new themed page, what does that new themed page look like?

Have you tried testing this out?

Different base resources for an environment

dan — Invalid Date

The best way to do this is to put a value on the tenant.data object. From there you can access it in each theme.

So, for the tenant in the dev environment, set tenant.data.assethost to dev.example.com. For the prod environment, set tenant.data.assethost to dev.example.com.

Then, in your theme, you'd have something like this:

The reason to use the tenant object is that it is available on every theme template.

This does mean that your tenant configuration will differ slightly between environments. You can also replicate this field value between tenants if you are using multiple tenants.

How can I pass info from a external identity provider to a JWT in FusionAuth

dan — Invalid Date

The way to do this is to use the user.data or registration.data objects as a transfer mechanism.

If you are using OIDC (SAML is much the same, but I'll use OIDC as an example), you can create a OIDC Reconcile Lambda. It might look like this:

// Using the JWT returned from UserInfo, reconcile the User and User Registration. function reconcile(user, registration, jwt) { user.data.favoriteColor = jwt.favoriteColor; }

So the jwt in this case is that returned from the OIDC identity provider. We store the data in user.data.

Now we need to pull it off of the user.data object using a JWT populate lambda. That might look a little something like this:

// Using the user and registration parameters add additional values to the jwt object. function populate(jwt, user, registration) { jwt.favoriteColor = user.data.favoriteColor; }

favoriteColor is now available as a claim in the JWT produced by FusionAuth.

Don't forget to assign your lambdas to the correct operations. The OIDC Identity provider needs to be configured with the reconcile lambda. The application's JWT tab is the right place to configure the use of the JWT populate lambda.

More information on all the lambda options available here: https://fusionauth.io/docs/v1/tech/lambdas/

Can I add new functionality to the login page?

dan — Invalid Date

You have a few options to do this. Unfortunately the login page, while very customizable in terms of look and feel via themes, is less customizable in terms of functionality and adding fields. Here are some options:

don't use our hosted login pages, instead build your own login pages (and all the other stuff like reset password, etc) using the Login API. You get total control of the login experience, at the cost of more custom code. check for consent when the application is loaded, after authentication. You could store a consent variable on the user object (in the data field) or use our consent model. Basically, after the user authenticates, take them to an interstitial page unless they have given consent. Put that logic in the application page they first land on. use javascript and customize the theme. Add a consent checkbox to the login form, and set a cookie once the user consented so you don't record the consent multiple times. Make a call via javascript to an API (which you'd have to write) to record when the consent was given.

Another option would be to use advanced registration forms for self registration and create a consent that would be required at sign up. Naturally, this doesn't help if you aren't using self service registration.

Groups as companies

dan — Invalid Date

Hi @harunkilic ,

Welcome to the FusionAuth community! I am glad you like the software.

You can't create group fields. What you can do is assign roles to a group. If a user is in that group and registered for an application with those roles, they will assume the roles. For example:

User A is in Group B. Group B has roles 1, 2, and 3. Role 1 is in Application Z. Role 2 and 3 are in Application X.

If user A is registered for application X and is in Group B, they will have roles 2 and 3. They won't have role 1 because that is associated with application Z, which they are not registered for.

You can't build your own entities, though that is on our roadmap. Follow this issue to be updated on when that feature is implemented. Full transparency, it will likely be a feature limited to our paid editions; learn more about our paid editions here.

Whether groups make sense depends on a lot of things.

Some questions to consider:

Are you limiting application access by group? Are you going to be using the API to do so, or do you want to have the information in the JWTs and available after authentication? Does each company have an application? Are you going to use the hosted login pages or build your own?

I can't give extensive architectural advice, but maybe if you talk a bit more about your use case the choice will be clearer.

How do I add a locale to FusionAuth?

dan — Invalid Date

There's additional localization and internationalization doc that was written recently here: https://fusionauth.io/docs/v1/tech/core-concepts/localization-and-internationalization/

Customizing the freemarker theme templates

dan — Invalid Date

You can put whatever you want in the theme pages, but it's a good idea to keep them lean so the user has a quick login experience. After all, most folks don't care about auth except when it doesn't work!

You can optionally pass info in the state parameter, that will come back to the caller. This can be encoded JSON, as long as it is url safe. You will want to make sure that you don't put too much stuff in there, as there are URL length limits for browsers (though I learned that chrome has a URL size limit of 2MB!). Here's an example of using the state parameter for application state.

Or if you have different applications and redirect URLs, then just gathering metrics on the URLs may give you insight into who is using login, and from where.

Sort of depends upon what type of analytics you need.

How can I use a custom font when customizing my theme?

dan — Invalid Date

In order to use a custom font within a publicly accessible FusionAuth template for a hosted deployment, pull the font from a CDN or other server hosting the font.

FusionAuth doesn't have any persistent storage for custom theme assets. You can use any font you like as long as it can be included via a tag.

Can FusionAuth host my images?

damien — Invalid Date

@dan I would love for this to be included in the themes documentation since it's something that every theme developer needs to figure out, and of course the default theme's assets (favicon etc.) are hosted locally and served by the FusionAuth server itself - so the answer that this can't be done for your own theme assets is non-obvious!

Social providers in Register web page

dan — Invalid Date

Hiya,

The issue is that the identityProviders map needs to be populated for that login script to work, and the class behind this page doesn't provide that map. So for now I don't see a way to do this.

There is an open github issue to allow identity providers to be displayed on the registration page. I'd suggest adding your use case to that issue: https://github.com/FusionAuth/fusionauth-issues/issues/554 and I'm happy to rename it to something more general. Alternatively you can file a new issue if you feel the use case is distinct enough.

I want to create my own login form.

dan — Invalid Date

If you have your own login form, you'll either be using the Login API or the OAuth Password grant. You will use one or the other, not both, each option will provide you roughly the same functionality. Totally up to you, the Login API is our own creation, the Password grant is defined by the OAuth RFC.

High level:

Collect email and password Call the Login API or the Token endpoint using the Password grant Collect the JSON response which will contain an access token (JWT)

Password Grant: https://fusionauth.io/docs/v1/tech/oauth/endpoints#resource-owner-password-credentials-grant-request
https://fusionauth.io/docs/v1/tech/oauth/#example-resource-owner-password-credentials-grant

Is it possible to add custom headers to emails sent by FusionAuth?

dan — Invalid Date

You can now do so as of FusionAuth 1.32.

More details in the issue 628 linked above.

I need feature ABC and am willing to pay you to build it. How can I get in touch?

dan — Invalid Date

While we continue to improve FusionAuth (and will always have a free community edition), if you are interested in paying for a specific feature to be built, we're happy to chat. Please contact us and we'll be happy to discuss costs and timelines.