Managing User Synchronization and ID Consistency with FusionAuth Generic Connectors
-
We plan to use a generic connector solely for authentication, with the “Migrate user” flag set to “No.” According to the FusionAuth documentation, the connector’s user object must include an id and either a username or email.
When a user logs in for the first time, FusionAuth creates a user object. On subsequent logins, FusionAuth synchronizes this user object with the external source.
Questions:
- Is there a way to prevent errors if the connector returns a user object where the email remains the same, but the id is different on subsequent logins?
- Is it possible to disable FusionAuth’s synchronization of the user object after every successful login?
-
There isn’t a way to stop FusionAuth from synchronizing the user object when using a generic connector. Even when a third-party system is the “system of record,” FusionAuth still requires a local user record to support its internal workflows and features. If you choose not to migrate users into FusionAuth, your external system must also provide application registrations on the returned user object to ensure proper integration.
Regarding your first question, there’s no way to prevent an error if the user.id changes between logins. The id field in the user object should remain consistent across logins. Changing it will inherently cause issues with how FusionAuth matches and manages user records.
For more detail, see the documentation here:
Using the Generic Connector as the System of Record