Posts made by dan

dan

It's a subtle difference, but one-time use refers to the value of the refresh token, which you use against the /oauth2/token endpoint to get a new access token via the refresh grant.

A sliding window refers to the refresh token itself, which has a unique id which stays the same, even as the value of the refresh token changes.

So if you had a refresh token with a lifetime of 4 hours, a sliding window and one time use configured, you might end up with something like this:

at creation: id 09cfb961-291a-420f-b5cf-48c5c87a67cc, value RNhY5yE39t1o2FXKxgyH, lifetime 4 hours
when the RT is presented to the /oauth2/token endpoint 3 hours after creation: id 09cfb961-291a-420f-b5cf-48c5c87a67cc, value Fh95KZLfSMjMNxpR5B4c, lifetime 4 more hours
when the RT is presented to the /oauth2/token endpoint 3 hours later: id 09cfb961-291a-420f-b5cf-48c5c87a67cc, value baHneP4s0hBHPEk88GPC, lifetime 4 more hours

More details here: https://github.com/FusionAuth/fusionauth-issues/issues/2925

dan

If you have one-time use refresh token, then every time it is used, you get a new refresh token.

If you have a refresh token with a sliding window, every time you use it, its lifetime is extended.

How are these settings compatible?

dan

Here's the PR making the doc better:

https://github.com/FusionAuth/fusionauth-site/pull/3371

dan

Also, why doesn't FusionAuth expose the default signing key, HS256, at http://localhost:9011/.well-known/jwks.json?

@fusionauth-qhj5e We don't publish the HMAC key to JWKS.json because if we did, anyone would be able to find it, and sign JWTs as your FusionAuth installation. HMAC keys should only be used when both parties can share a secret.

I'll update the docs to make that clearer. Sorry!

https://fusionauth.io/docs/lifecycle/authenticate-users/oauth/endpoints#json-web-key-set-jwks

dan

@sspinn Hiya, I'm in the admin console pretty regularly and haven't seen this behavior.

Can you narrow down the replication steps so we can try to recreate?

Which version of FusionAuth you are running and what database you are using will also be helpful.

dan

Another option that works as of today is to set up a tenant to tenant connector.

Add a connector to the new tenant. Point it at the /api/login endpoint of the old tenant, including an API key as a header.

Change your app to send everyone to a new application in the new tenant.

When the user logs in to the new application, if it is the first time they've been seen, the old tenant data, including password, will be queried. The password hash will be transparently migrated to the new tenant.

This slow migration takes time, but is another option.

dan

Hi @jamesbaxter . Sorry, just saw this now. I don't have the example app available. Sorry!

dan

When I navigate to the Reactor page, it shows that it's licensed with a Community Edition license.

Custom form fields require a starter license, and because you modified the form field names, FusionAuth thinks you are trying to use a custom form field. (Note, I'm not suggesting you buy a license--this functionality should work in community edition--but I wanted to explain why you are getting the message.)

With the move to 1.53.2 did you upgrade or use a new instance? If the former, does the issue still appear in a new install?

dan

FusionAuth Cloud instances may or may not have static egress IP addresses; please open a support ticket with your instance name to learn more.

VPC peering is not currently supported, though that issue is the right one to follow for future developments.

You can also use an LDAP proxy to solve this issue.

FusionAuth -> LDAP proxy -> AD

where the LDAP proxy is in the DMZ and AD is configured to only talk to internal network values or the LDAP proxy.

Here's a StackOverflow post with more details.

dan

I want to lock down access between ActiveDirectory and FusionAuth running in the cloud. What is the best way to do that? Can I use VPC peering? It appears to not be supported: https://github.com/FusionAuth/fusionauth-issues/issues/1147

dan

The best way to see this is to visit the theme history github repo.

It is mentioned in the theme upgrade documentation.

dan

I'm using advanced themes and want to see what has changed between releases so I can make sure to incorporate the changes in my custom theme.

What is the best way to see the changes?

dan

Currently this is not editable in the Admin UI. This value can be set by calling the Tenant API, however.

Docs here: https://fusionauth.io/docs/apis/tenants#update-a-tenant

dan

Is there a way in the admin UI to edit a tenant's data properties?

dan

I was able to do this by:

copying the advanced theme
editing it
navigating to the Helpers file
inside that, going to the head freemarker macro

I removed these lines:

  <link rel="stylesheet" href="/css/font-awesome-4.7.0.min.css"/>
  <link rel="stylesheet" href="/css/fusionauth-style.css?version=${version}"/>

  [#-- Theme Stylesheet, only Authorize defines this boolean.
       Using the ?no_esc on the stylesheet to allow selectors that contain a > symbols.
       Once insde of a style tag we are safe and the stylesheet is validated not to contain an end style tag --]
  [#if !(bypassTheme!false)]
    <style>
    ${theme.stylesheet()?no_esc}
    </style>
  [/#if]

If you want to use the CSS field in the theme to store your CSs, leave in

[#if !(bypassTheme!false)]
    <style>
    ${theme.stylesheet()?no_esc}
    </style>
[/#if]

which pulls in the CSS associated with the theme. Doing so allows you to add all your custom CSS to the CSS field in the theme and have it automatically included. If you don't do this, make sure you add your CSS to this macro (either directly or via a link). You'll want to make sure you keep it in as you upgrade.

Removing all the CSS will result in a page that looks like the one below.

unstyled login page

dan

Is there a way to strip the default CSS from the FusionAuth hosted login pages, leaving essentially just bare-bones HTML?

dan

You can also use our GitHub action to easily add FusionAuth to a GitHub workflow.

Here's the action: https://github.com/FusionAuth/fusionauth-github-action

Here's doc about how to use it: https://fusionauth.io/docs/get-started/run-in-the-cloud/github-actions

dan

If you see an error message like https://YOURFUSIONAUTHSERVER/en?error=invalid_request&error_reason=missing_code_challenge&[…]The+request+is+missing+a+required+parameter%3A+code_challenge

it is because you have required PKCE for your application, but have not provided those parameters when attempting a login/registration. The links that we autogenerate in the app will not have a code_challenge by design, because those are dynamic for each request.

You can learn more about PKCE and turning it off on the applications core concepts page.

dan

There is no webhook for this. You have a couple of options.

When the login event happens, you can look up the refresh token associated with that login event. You'd match based on application and time.

Then you can look up the application or tenant level refresh token lifetime and calculate out when the refresh token will expire.

Depending on the refresh token usage settings, refresh token lifetime might extend based on usage, so you might need to recalculate the lifetime based on that.

Then you'd know expiration time and refresh token id by querying this dataset.

You can also poll FusionAuth directly, using the APIs. You'd still need to keep track of valid refresh tokens in a separate datastore, then use the APIs to pull the valid refresh tokens. You can pull refresh tokens by user, but not at a coarser level of granularity. When you do so, use startInstant combined with the application or tenant level refresh token configuration.

dan

I can use this event to listen for when a refresh token is revoked, but is there a way to be informed when a refresh token expires?