# External JWT Reconcile Lambda

Learn how to map the claims in an external JWT to a FusionAuth user and registration with a reconcile lambda.

> For the index of this section of the site, see [llms.txt](https://fusionauth.io/docs/llms.txt)

When an External JWT identity provider is used to complete a federated login request, FusionAuth will use the [configured linking strategy](https://fusionauth.io/docs/authentication/identity-providers.md#linking-strategies) to reconcile the user. FusionAuth will attempt to match the user information returned from the External JWT identity provider to an existing user account or create a new one.

You may optionally utilize a lambda to customize the user and user registration during the authentication event.

When you create a new lambda using the FusionAuth Admin UI, you will be provided an empty function to implement.

Starting in version 1.65.0, you can use [attribute mappings](https://fusionauth.io/docs/authentication/identity-providers.md#attribute-mappings) to map IdP claims directly to FusionAuth user and registration fields without writing a lambda. Reconcile lambdas and attribute mappings are mutually exclusive. Attempting to configure both on a given IdP results in a validation error.

## Lambda Structure

If you are using the API to create the lambda you will need to ensure your function has the following signature:

```javascript
function reconcile(user, registration, jwt, context)  {
  // Lambda code goes here
}
```

This lambda must contain a function named `reconcile` that accepts the following parameters:

*   `user` - the FusionAuth User object. You can modify this object. However, the **email** and **username** attributes may not be modified after the user has been linked.
*   `registration` - the FusionAuth UserRegistration object. You can modify this object.

*   `jwt` - the JSON payload returned by the external identity provider JWT. This object is read-only.
*   `context` - Available since `1.64.0` - an object containing the context of the request, including access to [secrets](https://fusionauth.io/docs/lambdas.md#secrets). This object is read-only.

The two FusionAuth objects are well documented in the [User API](https://fusionauth.io/docs/apis/users.md) and [Registration API](https://fusionauth.io/docs/apis/registrations.md) documentation. The `jwt` may contain various user claims to utilize during the reconcile process.

## Assigning The Lambda

Once a lambda is created, you may assign it to the External JWT identity provider in the IdP configuration.

Navigate to Settings -> Identity Providers and select your existing External JWT configuration or click Add provider and select External JWT if it has not yet been configured.

## Example Lambda

The following is a simple example of an External JWT reconcile lambda. You will need to modify it to suit your needs.

```javascript
// This is an example External JWT reconcile, modify this to your liking.
function reconcile(user, registration, jwt) {
  // User claims
  user.firstName = jwt.first_name;
  user.lastName = jwt.last_name;
  user.birthDate = jwt.birth_date;
  user.imageUrl = jwt.image_url;
  user.data = user.data || {};
  user.data['email'] = jwt.email;

  // Registration claims
  registration.data = registration.data || {};
  registration.data['iss'] = jwt.iss;
}
```

Related

[Lambdas Apple Reconcile Lambda Learn how to map the data from a Apple login to a FusionAuth user and registration with a reconcile lambda. fusionauth lambdaidentity provider reconcile](https://fusionauth.io/docs/lambdas/reconcile/apple-reconcile.md)

[Lambdas Epic Games Reconcile Lambda Learn how to map the data from a Epic Games login to a FusionAuth user and registration with a reconcile lambda. fusionauth lambdaidentity provider reconcile](https://fusionauth.io/docs/lambdas/reconcile/epic-games-reconcile.md)

[Lambdas Facebook Reconcile Lambda Learn how to map the data from a Facebook login to a FusionAuth user and registration with a reconcile lambda. fusionauth lambdaidentity provider reconcile](https://fusionauth.io/docs/lambdas/reconcile/facebook-reconcile.md)

[Lambdas Google Reconcile Lambda Learn how to map the data from a Google login to a FusionAuth user and registration with a reconcile lambda. fusionauth lambdaidentity provider reconcile](https://fusionauth.io/docs/lambdas/reconcile/google-reconcile.md)
---

## Other pages in Reconcile

> For the full index of this section, see [Lambdas](https://fusionauth.io/docs/llms-lambdas.txt).

- [Apple Reconcile Lambda](https://fusionauth.io/docs/lambdas/reconcile/apple-reconcile.md): Learn how to map the data from a Apple login to a FusionAuth user and registration with a reconcile lambda.
- [Epic Games Reconcile Lambda](https://fusionauth.io/docs/lambdas/reconcile/epic-games-reconcile.md): Learn how to map the data from a Epic Games login to a FusionAuth user and registration with a reconcile lambda.
- [Facebook Reconcile Lambda](https://fusionauth.io/docs/lambdas/reconcile/facebook-reconcile.md): Learn how to map the data from a Facebook login to a FusionAuth user and registration with a reconcile lambda.
- [Google Reconcile Lambda](https://fusionauth.io/docs/lambdas/reconcile/google-reconcile.md): Learn how to map the data from a Google login to a FusionAuth user and registration with a reconcile lambda.
- [HYPR Reconcile Lambda](https://fusionauth.io/docs/lambdas/reconcile/hypr-reconcile.md): Learn how to map the data from a HYPR login to a FusionAuth user and registration with a reconcile lambda.
- [LDAP Connector Reconcile Lambda](https://fusionauth.io/docs/lambdas/reconcile/ldap-connector-reconcile.md): Learn how to map LDAP attributes to a FusionAuth user with the LDAP Connector reconcile lambda.
- [LinkedIn Reconcile Lambda](https://fusionauth.io/docs/lambdas/reconcile/linkedin-reconcile.md): Learn how to map the data from a LinkedIn login to a FusionAuth user and registration with a reconcile lambda.
- [Nintendo Reconcile Lambda](https://fusionauth.io/docs/lambdas/reconcile/nintendo-reconcile.md): Learn how to map the data from a Nintendo login to a FusionAuth user and registration with a reconcile lambda.
- [OpenID Connect Reconcile Lambda](https://fusionauth.io/docs/lambdas/reconcile/openid-connect-response-reconcile.md): Learn how to map OpenID Connect claims to a FusionAuth user and registration with a reconcile lambda.
- [SAML v2 Reconcile Lambda](https://fusionauth.io/docs/lambdas/reconcile/samlv2-response-reconcile.md): Learn how to map a SAML v2 response to a FusionAuth user and registration with a reconcile lambda.
- [Sony PlayStation Network Reconcile Lambda](https://fusionauth.io/docs/lambdas/reconcile/sony-playstation-network-reconcile.md): Learn how to map the data from a Sony PlayStation Network login to a FusionAuth user and registration with a reconcile lambda.
- [Steam Reconcile Lambda](https://fusionauth.io/docs/lambdas/reconcile/steam-reconcile.md): Learn how to map the data from a Steam login to a FusionAuth user and registration with a reconcile lambda.
- [Twitch Reconcile Lambda](https://fusionauth.io/docs/lambdas/reconcile/twitch-reconcile.md): Learn how to map the data from a Twitch login to a FusionAuth user and registration with a reconcile lambda.
- [Twitter Reconcile Lambda](https://fusionauth.io/docs/lambdas/reconcile/twitter-reconcile.md): Learn how to map the data from a Twitter login to a FusionAuth user and registration with a reconcile lambda.
- [Xbox Reconcile Lambda](https://fusionauth.io/docs/lambdas/reconcile/xbox-reconcile.md): Learn how to map the data from a Xbox login to a FusionAuth user and registration with a reconcile lambda.