Also, why doesn't FusionAuth expose the default signing key, HS256, at http://localhost:9011/.well-known/jwks.json?
Because it doesn't, you haven't to change all machine oauth to use a custom key, otherwise access tokens can't be verified manually, in addition to not being verifiable using the introspection endpoint.
If you call the access token verification endpoint (https://fusionauth.io/docs/lifecycle/authenticate-users/oauth/endpoints#introspect), it responds successfully if you include as credentials the client id and client secret of the Entity that requested that access token from FusionAuth originally.
If you instead try to verify the token with another Entity's client id and client secret, you receive a 401 error (unauthorized).
But the whole point of having a verification endpoint is for a server to validate the token received from a client - and the server obviously won't have the client's secret. Since the server doesn't have the client secret, how is it supposed to validate a token using any secret other than the server's own secret? Is this an error in the permissions of the endpoint of FusionAuth? Otherwise I don't understand how a server can call this endpoint.
Thanks.
Oh, it's still an open bug - https://github.com/FusionAuth/fusionauth-issues/issues/2574. I'll ask there.
I've successfully linked a FA user to a Google user with the identity provider API, and the link API, but the forum post this article is based on said They'll also have a link that is accessible via the Link API. That link will contain the refresh token in the token field.
However, calling https://fusionauth.io/docs/apis/identity-providers/links#retrieve-a-link, gets the JSON below, containing NO access token for Google. Now I'm completely stuck, please advise:
data: {
identityProviderLink: {
displayName: 'richard@ritza.co',
identityProviderId: '26481189-e3f7-433f-804b-9643a025806a',
identityProviderName: 'fago',
identityProviderType: 'OpenIDConnect',
identityProviderUserId: '110494278199559678180',
insertInstant: 1729762805435,
lastLoginInstant: 1729762805435,
tenantId: 'd7d09513-a3f5-401c-9685-34ab6c552453',
token: '',
userId: '00000000-0000-0000-0000-111111111111'
}
Here's my current code:
<a href="https://accounts.google.com/o/oauth2/v2/auth?client_id=535042435541-eridnie9d09pa69dsq1hh066ushvp4e0.apps.googleusercontent.com&redirect_uri=http://localhost:3000/fago&response_type=code&scope=openid%20email%20profile%20https://www.googleapis.com/auth/contacts.readonly&state=STATE">
router.get("/fago", async function (req, res, next) {
console.log("IN FAGO");
try {
if (req.query.state != "STATE") {
throw new Error(
"State anti-forgery token returned from Google does not match token sent",
);
}
const params = {
applicationId: "e9fdb985-9173-4e01-9d73-ac2d60d1dc8e",
identityProviderId: "26481189-e3f7-433f-804b-9643a025806a",
data: {
code: req.query.code,
redirect_uri: "http://localhost:3000/fago",
},
};
const url =
"http://localhost:9011/api/identity-provider/login?idp_hint=26481189-e3f7-433f-804b-9643a025806a";
const results = await axios.post(url, params);
console.dir(params.data.code);
console.dir(results.status + " " + results.statusText);
console.dir(results.data);
res.redirect("/account");
} catch (error) {
next(error);
}
});
I'm being returned by FusionAuth status code 232 (which I can't find a meaning for anywhere), and the only field in data is pendingIdPLinkId. I don't know how to get a Google Calendar access token from this.
Hi, I'm writing an article on getting a user's Google contacts in a web app, via FusionAuth (FA), based on these two conversations:
"The brief says "that button uses the identity provider login OIDC API to complete the login. That is, the dev starts the OIDC process but FA completes it and holds the token. After the user connects Google, the application then calls into FA to get the refresh token. Then it can call the Google API to get the contacts"
There are some parts I'm confused about. Please clarify the best approach if you can:
Thanks.
PS. I wanted to my improve my knowledge of OAuth significantly for this article, but the "form" on this page to get your ebooks is just a grey line I can't interact with - https://fusionauth.io/ebooks/modern-guide-to-oauth
UPDATE WHILE WAITING FOR FORUM APPROVAL:
https://accounts.google.com/o/oauth2/v2/auth?client_id=535042435541-eridnie9d09pa69dsq1hh066ushvp4e0.apps.googleusercontent.com&redirect_uri=http://localhost:9011/api/identity-provider/login&response_type=code&scope=openid%20email%20profile%20https://www.googleapis.com/auth/contacts.readonly&state=STATE&idp_hint=26481189-e3f7-433f-804b-9643a025806a. That successfully directs the user to google, gets consent for contacts, and redirects the user back to http://localhost:9011/api/identity-provider/login?state=STATE&code=4/0AVG7fiTXd3CnD-ff3ga7Zs5BXgHoUbvnPw&scope=email%20profile%20https://www.googleapis.com/auth/contacts.readonly%20openid%20https://www.googleapis.com/auth/userinfo.profile%20https://www.googleapis.com/auth/userinfo.email&authuser=1&hd=ritza.co&prompt=consent. That doesn't seem to do anything though. I realised I'm supposed to redirect the user back to the app, then call the FusionAuth API from the server. Making progress here slowly...@dan Oh I see. The error in the response says:
"because it was missing a unique id in the [user.id] or enough information to store in FusionAuth (i.e. an email or username)"
In other words, "either Id or email" is missing from your request. Which makes boolean sense when thinking about it carefully.
But when first reading it, I though it meant "you need either Id or email", which is very different. I supplied one of those. I though that was what the "or" meant.
This error could be better as:
"because it was missing a unique id in the [user.id] or enough information to store in FusionAuth (i.e. an email or username). Both are necessary"
I think this might be a bug.
I made a web service for a Connector that returned:
return response.status(200).json({
user: {
'id': '647978c5-01a0-49b8-8f4f-daab25e7ce63',
'password': 'password',
'active': true
}
});
FusionAuth System Event Log said I hadn't given it a unique id, which is not true:
Generic Connector Debug Log for [Test] with Id [b9a215ed-3078-4339-9638-62416fd20837].
3/20/2024 01:58:58 PM Z Attempting authentication request to application with Id [e9fdb985-9173-4e01-9d73-ac2d60d1dc8e] from IP address [172.27.0.1] for [myemailaddress+frontegguserc@simplelogin.com] against the URL [http://host.docker.internal:6252].
3/20/2024 01:59:00 PM Z Endpoint returned status code [200].
3/20/2024 01:59:00 PM Z Connector User:
{
"active" : true,
"connectorId" : "e3306678-a53a-4964-9040-1c96f36dda72",
"data" : {
"hi" : "hi!"
},
"id" : "647978c5-01a0-49b8-8f4f-daab25e7ce63",
"memberships" : [ ],
"passwordChangeRequired" : false,
"preferredLanguages" : [ ],
"registrations" : [ ],
"twoFactor" : {
"methods" : [ ],
"recoveryCodes" : [ ]
},
"usernameStatus" : "ACTIVE",
"verified" : false
}
3/20/2024 01:59:00 PM Z
. WARNING DISCARDING USER Connector because it was missing a unique id in the [user.id] or enough information to store in FusionAuth (i.e. an email or username).
If I changed my service to instead return the below, the Connector works and logs me in.
return response.status(200).json({
user: {
'id': '647978c5-01a0-49b8-8f4f-daab25e7ce63',
'password': 'password',
'active': true,
'email': email,
'username': email
}
});
Either a Connector should work with only a UUID, or the code and docs should change to say it requires email and username too.
@mark-robustelli Oh ok, I'll set the password to a UUID then and set the user to change password on login. I'll try on Monday. Thanks for the forum link.
I'm trying to import users without a password hash from Frontegg using importUsers in the TypeScript SDK.
Although the importusers documentation, https://fusionauth.io/docs/apis/users#request-6, says only a username and email is required, the code is telling me You must specify the [user.password] property for each user.
I've set passwordChangeRequired to true. I see some of the other user API methods have sendSetPasswordEmail, but this isn't available on the import method.
Is there a setting I can change to allow import with no password? Or must I use another method? Or is this a bug? I don't think any of the other migration tutorials we've written haven't had password hashes available.
Thanks.