Topics tagged with users

I want to allow every user with a role to be granted access to all entities of a given type

dan — Invalid Date

I'd use a webhook to provision/deprovision the grants.

https://fusionauth.io/docs/v1/tech/events-webhooks/events/user-registration-create-complete/ has the roles for the application, so in the webhook, you can call the FusionAuth grant API to create or revoke the grant.

For initial setup, run a script to get all the users that have a given role (using a user search query) and then grant them access to all the entities.

Think about what happens when a new piece of equipment is added. From what I gather, all users with the "viewer" role will need to be granted access to that equipment. You can take care that of within the 'new equipment added' script: provision the equipment, then add the grant to all users with the "viewer" role.

Depending on when you are going to check the grant and the number of users and pieces of equipment, this may be a good thing to use a queue like SQS for, to add/revoke/update grants asynchronously.

Adding another fusionauth user to the admin

dan — Invalid Date

Hi @david-pautler,

Sorry for the confusion! The users in account.fusionauth.io and your cloud instance are a disjoint set and do not have to be related at all. There's no synchronization between these two sets of users, and they actually run on different virtual hardware and do not share a database.

So assigning roles to users in account.fusionauth.io won't have any effect on users in .

Import Users; don't error on the existing ones

joshua — Invalid Date

Hi @casper!

Welcome to the community. This is working as designed. The import API is currently designed to only write new records to the database and not check if the record is already duplicated. This is partly for performance reasons. It maybe be possible to write a script to check existing records, and then only import "new" users based on that feedback, but we do not have any current documented cases of this.

There is an option to get additional information about what is failing on your import.
https://fusionauth.io/docs/v1/tech/apis/users/#import-users

validateDbConstraints [Boolean] OPTIONAL Defaults to false Set this value to true in order to perform additional validation of the request. The import request is intended to be used to populate the initial set of users, this means FusionAuth does not expect to find duplicate users in the database. If a duplicate is encountered a 500 will be returned without this additional validation. If you intend to use this API with existing users in FusionAuth set this value to true to request additional validation be performed on the input request and a 400 response will be returned with JSON body indicating the duplicate values encountered. Setting this value to true will dramatically decrease the performance of this request. If importing large numbers of users in a single request you may need to increase request timeouts to ensure this request does not timeout before it has completed.

I hope this helps,
Josh

Disappearing users?

dan — Invalid Date

It may be that you have set up your system to remove unverified users after a certain period of time.

To modify this setting, navigate to Tenants > Edit Your Tenant > Email then to the Email verification settings section.

In this section, you can change your email verification requirements and durations.

How do I get more results than the default allowed by ElasticSearch?

joshua — Invalid Date

You have a few options.

Limit Query One option is to find a way to limit your search by logical increments. For example, if you are searching on users you may consider obtaining and appending results by first name in a loop.

As an example:

for (letter in [a...z]) { query + " AND user email starts with $letter" // do work } Use Version > 1.24.0 when pulling something like users

https://fusionauth.io/docs/v1/tech/apis/users/#request-parameters-12

Request Parameters accurateTotal [Boolean] OPTIONAL Defaults to false AVAILABLE SINCE 1.24.0 Set this value equal to true to receive an accurate hit count on the API response. By default the search engine will limit the hit count to 10,000 users. This means that even if your query may match more than 10,000 users, the returned total count will be 10,000. This is adequate for many use cases such as pagination and general purpose queries. If you are looking for an accurate user count that can exceed 10,000 matches, you will want to set this value equal to true.

What can I migrate from a different system

dan — Invalid Date

You can migrate all of your user data (store any non standard info in user.data), their roles, groups, application association, refresh tokens (so that someone using a TV app, for example, won't have to login again) and their password hashes.

Please see the FusionAuth migration guide for more.

Searching for users with the java client

dan — Invalid Date

Looking at https://github.com/FusionAuth/fusionauth-java-client/blob/master/src/main/java/io/fusionauth/client/FusionAuthClient.java#L3256

It appears there is no way to search using the Java client that uses a GET, only a POST. However, you can still provide the queryString in the JSON and it will be equivalent to the GET request.

Building this JSON:

{ "search": { "queryString": "fusionauth.io" } }

Is equivalent to queryString=fusionauth.io.

Hope that helps.

Can I find all users by tenant?

dan — Invalid Date

Try clicking on the Advanced section on the User Search page and see you find what you're looking for.

Or search like this tenantId:9d92ca33-bc7b-4d13-acd7-f7dc06038396 where 9d92ca33-bc7b-4d13-acd7-f7dc06038396 is your tenantId.

Please note that this is an example for the elastic search search engine. With the database search engine, you can only search for the fields as documented in the API. As of this post, those are:

firstName lastName fullName email username

Same email address across social providers

dan — Invalid Date

Each user is unique within a tenant by email address. If a user in the same tenant wants to login with Facebook, Google, or LinkedIn, it will be the same User object.

Groups as companies

dan — Invalid Date

Hi @harunkilic ,

Welcome to the FusionAuth community! I am glad you like the software.

You can't create group fields. What you can do is assign roles to a group. If a user is in that group and registered for an application with those roles, they will assume the roles. For example:

User A is in Group B. Group B has roles 1, 2, and 3. Role 1 is in Application Z. Role 2 and 3 are in Application X.

If user A is registered for application X and is in Group B, they will have roles 2 and 3. They won't have role 1 because that is associated with application Z, which they are not registered for.

You can't build your own entities, though that is on our roadmap. Follow this issue to be updated on when that feature is implemented. Full transparency, it will likely be a feature limited to our paid editions; learn more about our paid editions here.

Whether groups make sense depends on a lot of things.

Some questions to consider:

Are you limiting application access by group? Are you going to be using the API to do so, or do you want to have the information in the JWTs and available after authentication? Does each company have an application? Are you going to use the hosted login pages or build your own?

I can't give extensive architectural advice, but maybe if you talk a bit more about your use case the choice will be clearer.

How can I export my users from FusionAuth?

dan — Invalid Date

Yes. We don’t currently have an API to do this, but you can pull the users from your database, and the hashes are all available there. If you are using FusionAuth Cloud, you can request a database dump from us.

The hashing algorithm is customizable and you can select PBKDF2 or Bcrypt. You can see more about our hashing algorithm support here: https://fusionauth.io/docs/v1/tech/reference/password-encryptors/

Edited Sep 2023: Per our cloud documentation, database exports from FusionAuth Cloud are supported as one-time requests because of migration needs. Repeated exports require a discussion with the sales team.

What is considered "activity" for the daily and monthly active user reports?

dan — Invalid Date

There are two types of activity that are consolidated in this report. A user is 'active' if either of these holds true for the user during the time period in question.

The first is on token/JWT refreshes. There are two ways to trigger an activity event.

The first is a POST to /oauth2/token to retrieve a token (either with an auth code, a refresh token, or any other way to get a token). The second is a POST to /api/jwt/refresh, which presents a refresh token for a new access token using the FusionAuth non standard API.

The second is on "login" events:

an IdP login request (performed via a POST to /api/identity-provider/login user creation user registration to an application through a login performed via a POST to /api/login or a PUT to /api/login and finally through other forms of login that don't quite fall in those flows above. These include: passwordless, one time password and 2FA.

Basically, if a user logs in or has a token generated for them, they are considered active during the timeframe.

Retrieving all users

dan — Invalid Date

From the user search docs, for the database search engine:

Regular expressions may not be used. A value of * will match all records.

For the elasticsearch search engine, you are limited to 10,000 records returned due to this bug: https://github.com/FusionAuth/fusionauth-issues/issues/494

Here's docs on how to switch between them: https://fusionauth.io/docs/v1/tech/tutorials/switch-search-engines

Limit on deleting users

dan — Invalid Date

If you use the request body you should be fine. You can do a lot more than 500 if you like.

I would start with 5-10k and see how performance is.

How can I get all users active in the last three months?

dan — Invalid Date

To get User Ids, you’d want to use the Search API, and make requests in smaller windows to keep under 10k and than add the results. For example, you could request all users with a username starting with a, and then b, and so on. Definitely recommend scripting this.

As long as you have enough RAM for ElasticSearch, 10k for numberOfResults should be just fine. You’ll just need to make sure your query is narrow enough such that the totalNumberOfResults that comes back from FusionAuth is below 10k, otherwise you won’t know for sure if you received an exhaustive result set from your query.

We will be enhancing the Search API shortly to work around this Elasticsearch limitation (github issue).

List all users

dan — Invalid Date

There is a Totals report that is available in the UI or API.

https://fusionauth.io/docs/v1/tech/apis/reports#generate-totals-report

Does FusionAuth support guest users?

dan — Invalid Date

We don't support this currently. If you have a use case that this would be helpful for, please file a GitHub issue explaining what you are looking for.

It is sorta possible to create a user with a randomly generated email and password. So if you wanted to allow people to sign up, you could generate this user, and then send them/present login details, and then the user could be anonymous but still have a profile.

Preventing users from logging in?

dan — Invalid Date

Currently there is no way to prevent a user from doing what is outlined.

Please feel free to create an issue: https://github.com/fusionauth/fusionauth-issues

Creating a user with a hashed password

dan — Invalid Date

Currently the only way to accomplish this will be to use the Import API, as you mentioned: https://fusionauth.io/docs/v1/tech/apis/users#import-users

We do have an open feature request to allow hashes to be provided on the User API, which I think would be what you're looking for: https://github.com/FusionAuth/fusionauth-issues/issues/348

Feel free to upvote that issue.