I'd like to update the user data object in the UI. I know I can do it via the API: https://fusionauth.io/docs/v1/tech/apis/users
dan
@dan
Head of Developer Relations at FusionAuth.
Enjoys ruby, java, php. Finds golang challenging.
Likes the authorization code grant, automation, stories and clear documentation.
Hiker, camper, gardener. Used to have chickens, now just tomatos.
Best posts made by dan
-
Is there a way to update user data in the UI?
-
Can I configure the inactivity timeout of the FusionAuth Session cookie?
I have a quick question about FusionAuth and configuring the inactivity timeout of the session cookie it creates. Specifically... Is it possible?
-
Terraform provider for FusionAuth released
There's now an open source terraform provider available: https://github.com/gpsinsight/terraform-provider-fusionauth
It's also on the registry: https://registry.terraform.io/providers/gpsinsight/fusionauth/latest
-
RE: Block authentication until user is verified?
Is modifying the JWT via a lambda equivalent to accessing the verified property of the user profile?
Within a lambda, you have access to the user and registration properties. So you'd pull the
verified
property from wherever you wanted and put it into the JWT as a custom claim. Here's a blog post about how that might work.So yes, it is the same data. It's the tradeoff between a bigger JWT and having to make the additional call from your API.
Don't forget that the JWT will live for a while, so if this sequence happens and you use the JWT, you might have a user with a verified email prevented from using the API.
- user registers
- JWT issued, with
verified
set tofalse
because the user isn't verified. - User verifies their email
- User visits API, but is denied because the JWT has stale data.
I don't know timelines and how long your JWTs live for, but this is something to consider. Does that answer your question?
-
RE: My JWKS are always empty
Symmetric keys are not returned on the JWKS endpoint, as they don't have a public key. Per the docs this api:
returns public keys generated by FusionAuth, used to cryptographically verify JWTs using the JSON Web Key format
If you create an RSA or EC key which is an asymmetric key pair - the public key will be returned on the JWKS endpoint. If you don’t have any key pairs configured , it will be empty. Out of the box, you’ll only have one HMAC key which we don’t publish in JWKS.
-
RE: Implementing a Role-Based Access System for Authorization
Ah, I just tested this out and if you don't need it in the JWT, you should be able to see it in the registrations object returned after login.
Here's a response I get after logging in:
{ "token": "ey...", "user": { "active": true, "connectorId": "e3306678-a53a-4964-9040-1c96f36dda72", "email": "email@example.com", "id": "2df13f18-01cc-48a4-b97a-2ab04f98d006", "insertInstant": 1592857899119, "lastLoginInstant": 1596819645662, "lastUpdateInstant": 0, "passwordChangeRequired": false, "passwordLastUpdateInstant": 1592857899145, "registrations": [ { "applicationId": "78bd26e9-51de-4af8-baf4-914ea5825355", "id": "73d2317b-d196-4315-aba2-3c205ed3ccae", "insertInstant": 1592857899151, "lastLoginInstant": 1592857899153, "lastUpdateInstant": 1596813810104, "roles": [ "Role1" ], "usernameStatus": "ACTIVE", "verified": true } ], "tenantId": "1de156c2-2daa-a285-0c59-b52f9106d4e4", "twoFactorDelivery": "None", "twoFactorEnabled": false, "usernameStatus": "ACTIVE", "verified": true } }
So
user.applicationId.roles
is what you want. Note that roles are applied on an application by application basis. If a user is in a group which has a role 'roleA' which is created in 'applicationA', but is not registered for 'applicationA', they won't receive that role. More on that here: https://fusionauth.io/docs/v1/tech/core-concepts/groups -
RE: Trouble getting the user object post login
OK, we just released 1.18.8 and that is the version you want to use:
In
requirements.txt
:fusionauth-client==1.18.8
And then this is the call you want to make (with
client_id
beforeredirect_uri
) :resp = client.exchange_o_auth_code_for_access_token(request.args.get("code"), client_id, "http://localhost:5000/oauth-callback", client_secret)
-
RE: Specifying password during user registration.
Hiya,
First off, we'd recommend having all the flow you outline be over TLS. That's good enough for most major ecommerce systems and so shouldn't be insecure. If you aren't serving your application over TLS, then I'd advise doing so. And note that the flow is actually:
My Frontend
-->My Backend
-->FusionAuth API
There's no password returned from the registration API call.
If you are concerned about a new user's password being insecurely transmitted through your application, you could use the FusionAuth hosted login pages and theme them to be like your application. (More docs.)
The other option, which takes encrypted passwords, is the Import Users API, but that's probably not a fit for one off registrations. There are no plans to accept encrypted passwords for one off user registrations. Here's a related issue you can weigh in on/vote up if you'd like. Or feel free to open a new issue if that one doesn't capture the essence of your idea.
Are there specific security concerns you have around your front end/back end systems that I might be missing?
Latest posts made by dan
-
RE: ActiveDirectory access to FusionAuth
FusionAuth Cloud instances may or may not have static egress IP addresses; please open a support ticket with your instance name to learn more.
VPC peering is not currently supported, though that issue is the right one to follow for future developments.
You can also use an LDAP proxy to solve this issue.
FusionAuth -> LDAP proxy -> AD
where the LDAP proxy is in the DMZ and AD is configured to only talk to internal network values or the LDAP proxy.
Here's a StackOverflow post with more details.
-
ActiveDirectory access to FusionAuth
I want to lock down access between ActiveDirectory and FusionAuth running in the cloud. What is the best way to do that? Can I use VPC peering? It appears to not be supported: https://github.com/FusionAuth/fusionauth-issues/issues/1147
-
RE: Is there a way to see how advanced themes have changed between releases?
The best way to see this is to visit the theme history github repo.
It is mentioned in the theme upgrade documentation.
-
Is there a way to see how advanced themes have changed between releases?
I'm using advanced themes and want to see what has changed between releases so I can make sure to incorporate the changes in my custom theme.
What is the best way to see the changes?
-
RE: How do I edit a tenant’s data properties via the dashboard?
Currently this is not editable in the Admin UI. This value can be set by calling the Tenant API, however.
Docs here: https://fusionauth.io/docs/apis/tenants#update-a-tenant
-
How do I edit a tenant’s data properties via the dashboard?
Is there a way in the admin UI to edit a tenant's data properties?
-
RE: How can I remove all CSS from the FusionAuth hosted login pages?
I was able to do this by:
- copying the advanced theme
- editing it
- navigating to the Helpers file
- inside that, going to the
head
freemarker macro
I removed these lines:
<link rel="stylesheet" href="/css/font-awesome-4.7.0.min.css"/> <link rel="stylesheet" href="/css/fusionauth-style.css?version=${version}"/> [#-- Theme Stylesheet, only Authorize defines this boolean. Using the ?no_esc on the stylesheet to allow selectors that contain a > symbols. Once insde of a style tag we are safe and the stylesheet is validated not to contain an end style tag --] [#if !(bypassTheme!false)] <style> ${theme.stylesheet()?no_esc} </style> [/#if]
If you want to use the CSS field in the theme to store your CSs, leave in
[#if !(bypassTheme!false)] <style> ${theme.stylesheet()?no_esc} </style> [/#if]
which pulls in the CSS associated with the theme. Doing so allows you to add all your custom CSS to the CSS field in the theme and have it automatically included. If you don't do this, make sure you add your CSS to this macro (either directly or via a
link
). You'll want to make sure you keep it in as you upgrade.Removing all the CSS will result in a page that looks like the one below.
-
How can I remove all CSS from the FusionAuth hosted login pages?
Is there a way to strip the default CSS from the FusionAuth hosted login pages, leaving essentially just bare-bones HTML?
-
RE: How do I use FusionAuth in my CI/CD system?
You can also use our GitHub action to easily add FusionAuth to a GitHub workflow.
Here's the action: https://github.com/FusionAuth/fusionauth-github-action
Here's doc about how to use it: https://fusionauth.io/docs/get-started/run-in-the-cloud/github-actions
-
RE: Can I link to the self registration URL from my app?
If you see an error message like
https://YOURFUSIONAUTHSERVER/en?error=invalid_request&error_reason=missing_code_challenge&[…]The+request+is+missing+a+required+parameter%3A+code_challenge
it is because you have required PKCE for your application, but have not provided those parameters when attempting a login/registration. The links that we autogenerate in the app will not have a code_challenge by design, because those are dynamic for each request.
You can learn more about PKCE and turning it off on the applications core concepts page.