External JWT Reconcile Lambda

When an External JWT identity provider is used to complete a federated login request, FusionAuth will use the configured linking strategy to reconcile the user. FusionAuth will attempt to match the user information returned from the External JWT identity provider to an existing user account or create a new one.

You may optionally utilize a lambda to customize the user and user registration during the authentication event.

When you create a new lambda using the FusionAuth administrative user interface, you will be provided an empty function to implement.

Lambda Structure

If you are using the API to create the lambda you will need to ensure your function has the following signature:

function reconcile(user, registration, jwt)  {
  // Lambda code goes here
}

This lambda must contain a function named reconcile that takes three parameters. The parameters that the lambda is passed are:

user - the FusionAuth User object. You can modify this object. However, the email and username attributes may not be modified after the user has been linked.
registration - the FusionAuth UserRegistration object. You can modify this object.

jwt - the JSON payload returned by the external identity provider JWT. This object is read-only.

The two FusionAuth objects are well documented in the User API and Registration API documentation. The jwt may contain various user claims to utilize during the reconcile process.

Assigning The Lambda

Once a lambda is created, you may assign it to the External JWT identity provider in the IdP configuration.

Navigate to Settings -> Identity Providers and select your existing External JWT configuration or click Add provider and select External JWT if it has not yet been configured.

Example Lambda

The following is a simple example of an External JWT reconcile lambda. You will need to modify it to suit your needs.

// This is an example External JWT reconcile, modify this to your liking.
function reconcile(user, registration, jwt) {
  // User claims
  user.firstName = jwt.first_name;
  user.lastName = jwt.last_name;
  user.birthDate = jwt.birth_date;
  user.imageUrl = jwt.image_url;
  user.data = user.data || {};
  user.data['email'] = jwt.email;

  // Registration claims
  registration.data = registration.data || {};
  registration.data['iss'] = jwt.iss;
}

Results