Solved. The error code coming back is [duplicate]user.email. I just need to ignore that!

Thx Dan, I read it. It might be more trouble than it is worth. I am thinking a link from landing page to the initiation of the passwordless might do the trick, although i do need the users to register (both for fa and for me).

      <a href="http://localhost:9011/oauth2/register?client_id=f603697d-41ea-4c53-xxxx-e935d5e34221&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%2Findex.php%2FConfigure%2Fcampaign_management_with_actions">Register</a>

Thanks Dan. As soon as my consultant get the API for php installed I will get right on it.

Perfect. thx

Never mind. I solved this. I thought that "change password" was going to be a prompt for the user, not for me to set up the password. Once I did, it worked.

Are you asking for some free consulting ?

No, I can play this "trial and error" game for months :). Seriously though, I am a little concerned that I couldn't enter the URL for quite a few days and then it started working. I just want to be sure that the authorized request origin URL is actually being used. Is there some easy way to test that without using the API?
Did I mention that I appreciate your help and the T-shirt too?

Solved (I think). This line above needed to be changed
from
$client = new FusionAuth\FusionAuthClient($apiKey, "http://localhost:9011");
to
$client = new FusionAuth\FusionAuthClient( $apiKey, "http://fusionauth:9011");

Now I get the error code lijke in your example that will allow me to fix this thing. In your example above you use localhost too. So how does yours work when mine does not? I am using Docker btw. If using fusionauth:9011 will cause me other headaches, please let me know before I break out the champagne!

Also, we discussed putting my client secret in the Oauth login URL. I was concerned about security when doing that. Can you please recommend an easy, more secure place to keep those fields?

solved. I needed to type DELETE.

I am using the php client. In the documentation (https://github.com/FusionAuth/fusionauth-php-client/blob/master/src/FusionAuth/FusionAuthClient.php) there are 5 function calls that start with the word "send". Here they are:
public function sendFamilyRequestEmail($request)
public function sendEmail($emailTemplateId, $request)
public function sendPasswordlessCode($request) <<<this one works!!
public function sendTwoFactorCode($request)
public function sendTwoFactorCodeForLogin($twoFactorId)

I got it working! As you can see the php client doesn't line up EXACTLY with the passwordless guide.

Thanks. I didn't actually see that other response until just now. I will act on it.

@joshua I am pretty far beyond just setting up :). The passwordless email gets sent to the user. When they open it they see a button. Here is the text of the button

<a rel="nofollow noopener noreferrer" target="_blank" onclick="return window.theMainWindow.showLinkWarning(this)" href="http://35.153.28.164:9011/oauth2/passwordless/Hpwfsd2h-82faVz7oFYpX6xg0k43aIFM0d54-ueW7dc?tenantId=4272f95b-0989-4892-badc-0ef6b934885f&amp;client_id=f603697d-41ea-4c53-ac2d-e935d5e34221&amp;redirect_uri=35.153.28.164%2Findex.php%2FConfigure%2Freport_generator_amazing&amp;response_type=code&amp;scope=openid&amp;state=richardbernstein216%40yahoo.com">
<button style="border:none;color:white;padding:15px 32px;text-align:center;text-decoration:none;font-size:16px;margin:4px 2px;cursor:pointer;background-color:#008CBA;">
Click Here to Login!
</button>
</a>

This looks fine to me except for the redirect_uri=35.153.28.164%2Findex.php%2

Shouldn't that be redirect _uri=http://35.153.28.164%2Findex.php%2 ????
Why is the http:// being cut off by fa?
BTW I am using v 1.19.7

@robotdan said in invalid_redirect_uri:

http://35.153.28.164/index.php/Configure/report_generator_amazing

You are right! The http:// is missing in one place (for example)
redirect_uri=35.153.28.164%2Findex.php%2FC

But I included it in the URI redirect field in the Home/applications/edit uri field (see below) and it appears in other places in the screenshot. How can that be?

<a rel="nofollow noopener noreferrer" target="_blank" onclick="return window.theMainWindow.showLinkWarning(this)" href="http://35.153.28.164:9011/oauth2/passwordless/Hpwfsd2h-82faVz7oFYpX6xg0k43aIFM0d54-ueW7dc?tenantId=4272f95b-0989-4892-badc-0ef6b934885f&amp;client_id=f603697d-41ea-4c53-ac2d-e935d5e34221&amp;redirect_uri=35.153.28.164%2Findex.php%2FConfigure%2Freport_generator_amazing&amp;response_type=code&amp;scope=openid&amp;state=richardbernstein216%40yahoo.com">
<button style="border:none;color:white;padding:15px 32px;text-align:center;text-decoration:none;font-size:16px;margin:4px 2px;cursor:pointer;background-color:#008CBA;">
Click Here to Login!
</button>
</a>

In looking at the text of the passwordless login email above I see that the http// is missing! But as I showed you in a screenshot below it is in the proper place. What is cutting it off? Has anyone else had this issue?

@dan Thanks Dan. I really just need 2 mins of support. Can you tell me what log to look into to see the issue? I have http:// already in the URI.
Here is what I see in the dockerlog for the fusionAuth container:

2021-05-06 7:15:54.736 AM WARN  com.zaxxer.hikari.pool.PoolBase - HikariPool-1 - Failed to validate connection com.mysql.cj.jdbc.ConnectionImpl@50b27d35 (No operations allowed after connection closed.). Possibly consider using a shorter maxLifetime value.
2021-05-06 7:15:54.738 AM ERROR com.inversoft.scheduler.LogAndRetainFailureHandler - The scheduled service [class io.fusionauth.api.service.system.NodeManager] failed but will be re-run.
org.apache.ibatis.exceptions.PersistenceException: 
### Error querying database.  Cause: java.sql.SQLTransientConnectionException: HikariPool-1 - Connection is not available, request timed out after 2024ms.
### The error may exist in io/fusionauth/api/domain/FusionAuthNodeMapper.xml
### The error may involve io.fusionauth.api.domain.FusionAuthNodeMapper.retrieveAll
### The error occurred while executing a query

and a little down the same log file:

### Error querying database.  Cause: java.sql.SQLTransientConnectionException: HikariPool-1 - Connection is not available, request timed out after 2022ms.
### The error may exist in io/fusionauth/api/domain/KeyMapper.xml
### The error may involve io.fusionauth.api.domain.KeyMapper.retrieveAll
### The error occurred while executing a query
### Cause: java.sql.SQLTransientConnectionException: HikariPool-1 - Connection is not available, request timed out after 2022ms.

these keep recurring down the page. The only recommendation I see is "Possibly consider using a shorter maxLifetime value".
Can you tell me where I set this? Is this a fa thing or a ubuntu thing?

Or could this be that AWS won't accept a connection? Is this an issue for AWS tech support instead?

Thanks Joshua. I am trying to do a plain vanilla passwordless login. It all works fine. It sends the email directly to the user's email. When the user clicks on the link (in my case it is a button) the user gets the error below:
"error_description" : "Invalid redirect uri 35.153.28.164/index.php/Configure/report_generator_amazing",

Notice that the error message does NOT SHOW the http:// ?? Here is the application screen. Also notice that I do have the http://

So that is not the issue. I can get the docker log for you so you can see what fusionAuth is complaining about, if you think that would help? Is there any other logs kept by fa that I can look at?

Is there a consultant I could hire to help me get this aspect of passwordless working? This is Docker.

@dan The info popup on that page says that if left empty, all addresses are accepted.

Dan where does the list of valid redirect addresses go? Right below the line that is highlighted? I added in the 35.xx.xx.xx but I still get the same FA error popup.

@richb201 said in invalid_redirect_uri:

35.153.28.164/index.php/Configure/report_generator_amazing

Dan, can you give me a hint on how to debug this? Is there a log somewhere that will tell me why this is failing? I am running under docker. Is Github the proper place to ask this?

Re: Invalid redirect uri

I was having this problem about 18 months ago while working on a different part of the application. Now I am trying to do a passwordless to a gmail account and i am getting

{
  "error" : "invalid_request",
  "error_description" : "Invalid redirect uri 35.153.28.164/index.php/Configure/report_generator_amazing",
  "error_reason" : "invalid_redirect_uri"
}

At the tim ethe answer was that the email client that I was using for testing was mangling the email. But now I am using gmail. Can't be much more common than that!

I don't see anything wrong with that uri. When I copy it and paste it into the browser it seems to work fine (except for missing some data, that I will take care of). In this case I am using a gmail account. 18 months ago there was a bug dealing with pre-fetch (see previous topic). Was that ever solved?