Staff group

dan

The hosted backend is designed to cover a number of use cases, but is not very configurable.

If you need more control over the backend, it's suggested you stand up your own application backend to do the token exchange and set the cookies or otherwise store the access token. Many frameworks will take care of this for you.

FusionAuth has provided a sample express application that has the same functionality as the hosted backend and can be extended. For example, to change the domain of the cookie set, you can modify the cookie setting code here.

dan

We're using the FusionAuth hosted backend but want some more flexibility around the cookie names, domain and expiration times.

What is the best way to get that? File an issue? Raise a support ticket?

dan

@cierzniak I think you found a bug! @spencer filed an issue that looks related.

https://github.com/FusionAuth/fusionauth-issues/issues/2738

There's a workaround in the issue, which involves deleting a cookie.

Can you please try that and let us know if that resolves it?

dan

The best way to solve this is to use a <meta> element with its http-equiv set to Refresh in the <head> of the page.

When the page is displayed, the browser will go the indicated URL.

The Verify registration complete template can be updated like this, for example:

  [@helpers.head]
    [#-- Custom <head> code goes here --]
    <meta http-equiv="Refresh" content="0; URL=https://google.com/" />
  [/@helpers.head]

dan

When verifying a registration by following an email link, the user will ultimately end on a Registration verification complete page. This is a dead end page. Can the user be sent to a login screen for example?

dan

@alex-3 I'm a bit unclear on what you are trying to do.

Can you outline the exact steps you want to take?

dan

Sure!

This is a case of Third-Party Service Authorization where your application is trying to access data on behalf of users held by another party (Google in this case).

This will require some integration work on your part, but the basic steps are:

Integrate your application with FusionAuth (our quickstarts are a good place to start). Make sure you check the 'keep me signed in' value set, using a hidden field.
Set up an Identity Provider. You don't want to use the Google Identity Provider because it doesn't support the prompt URL parameter.
- Use the OIDC Identity Provider with the prompt parameter set to select_account to let the users pick different accounts, and make sure you set access_type to offline to get a refresh token. More here.
- Set the Linking strategy to Pending.
- You'll also need to set up your Google scopes correctly. Based on your question, you'll want to use https://www.googleapis.com/auth/calendar.events.readonly as an additional scope.
- You'll want to follow the Google Identity Provider instructions insofar as they pertain to navigating the Google Cloud Console.
Create an 'connect your account with google' button in your application. This should point to the OIDC Identity Provider. You can use an idp_hint to send the user directly to Google when they click it.
After they return from google, having selected their account, they should be logged in to your application. (It's possible with Pending they'll be prompted to login to your application again, but I don't think so. Would have to test.) They'll also have a link that is accessible via the Link API. That link will contain the refresh token in the token field.
- You can also iterate all the links in your application using one of our client libraries to display to the user which google accounts they have connected.

Now you have connected 1 or more Google accounts to a FusionAuth account.

Next, when you want to retrieve calendar events for your application to process, take these steps:

Call the Links API for the user to retrieve all the links
Retrieve the Google refresh token from the token field
Get a fresh access token using the Refresh grant
Use the access token to retrieve the event data using either the API or a Google SDK.
... profit!

If the refresh token has expired (you don't get back a valid access token), inform the user and have them go through the authorization process again.

Hope this helps.

dan

Hiya,

We have a situation where we have users. Each user has 1 or more Google accounts. We want to be able to read events from a calendar using Google APIs.

Is this something that FusionAuth can help with?

dan

This might be useful for visitors in the future: https://fusionauth.io/docs/extend/examples/device-limiting

dan

Hiya @kasir-barati ,

You can certainly use just a subset of known invite codes. In that case, no need to store the codes on the user.

Instead, add an array of codes in the self-service registration lambda and have a step check to see that the user provided code value matches one of the known values in the array.