It looks like setting the email address in a lambda works for Facebook now (as of at least 1.41.2):

if (!facebookUser.email) { user.email = facebookUser.id + '@no-email.facebook.com'; } 1/10/2023 10:10:33 PM Z Linking strategy [LinkByEmail] 1/10/2023 10:10:33 PM Z Resolved email to [] 1/10/2023 10:10:33 PM Z Resolved username to [null] 1/10/2023 10:10:33 PM Z Resolved unique Id to [115587478085870] 1/10/2023 10:10:33 PM Z Identity provider returned a unique Id [115587478085870]. 1/10/2023 10:10:33 PM Z A link has not yet been established for this external user. 1/10/2023 10:10:33 PM Z The user with the email address [] does not exist. 1/10/2023 10:10:33 PM Z Invoke configured lambda with Id [787cd34e-1618-4cd9-8156-936734cfe368] 1/10/2023 10:10:33 PM Z The lambda set or modified the initially resolved email. Email is now [115587478085870@no-email.facebook.com] 1/10/2023 10:10:33 PM Z Creating user: 1/10/2023 10:10:33 PM Z User is not registered for application with Id [e0da3f10-7efa-4a6b-95f8-fbf4894884b5] 1/10/2023 10:10:33 PM Z User has successfully been reconciled and logged into FusionAuth. 1/10/2023 10:10:33 PM Z Authentication type: FACEBOOK 1/10/2023 10:10:33 PM Z Authentication state: Authenticated

In the UI you can select "Special character" to require at least one special character. If anyone is looking to understand which characters will satisfy this requirement read on.

If you view the tooltip or the API - you’ll see the configuration is actually for non-alpha-numeric.

https://fusionauth.io/docs/v1/tech/apis/tenants#create-a-tenant

tenant.passwordValidationRules.requireNonAlpha
Whether to force the user to use at least one non-alphanumeric character.

So instead of limiting this to a specific set of special characters, we allow it to be any character that is not a unicode alphabetic and not a digit. In this way, we do not artificially limit the entropy of the password by saying you must use one or more characters for a finite set of "special characters" as you may be used to seeing on some login forms.

this section for localhost

server {

listen 80;

server_name YOURSITENAME.COM;

location / { proxy_pass http://127.0.0.1:9011; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; }

}
#######################################################################

this section for https (ssl)
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name YOURSITENAME.COM;

location / { proxy_pass http://127.0.0.1:9011; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; }

}

@chris-christensen

Update

I got the login working, in the application, I changed Client Authentication to Not required when using PKCE and I changed PKCE to Required. I also made sure all of my authorized urls were set to https://

I'm still getting the X-Frame-Option DENY in my console. The login process takes a long time to resolve, like 10 seconds or so and I think it's tied to the x-frame-option issue. I'm guessing, but maybe this has to do with the FusionAuth server running on http:// but I'm not sure.

Auth-wise, the only issue I have now is when I try to log out.

http://localhost:9011/oauth2/logout?id_token_hint=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImd0eSI6WyJhdXRob3JpemF0aW9uX2NvZGUiXSwia2lkIjoiNjgzODU2OTEtODJiOC00OGI4LTlhNWEtNTdjYTRkMDE3ODg2In0.eyJhdWQiOiI2ODM4NTY5MS04MmI4LTQ4YjgtOWE1YS01N2NhNGQwMTc4ODYiLCJleHAiOjE2NzE3MjUyOTQsImlhdCI6MTY3MTcyMTY5NCwiaXNzIjoiYWNtZS5jb20iLCJzdWIiOiJkZmU2ODE3Yy1kMDM0LTRkNDEtOWUyYi1mM2JmYjMyMjM5ZWUiLCJqdGkiOiJlZjYzOGNjZi1jOTY5LTRkODYtOTMzMS1lMWU3MjkxN2NiYmEiLCJhdXRoZW50aWNhdGlvblR5cGUiOiJQSU5HIiwiZW1haWwiOiJjaHJpcy5jaHJpc3RlbnNlbkBzaWx2ZXJmZXJuLmdyb3VwIiwiZW1haWxfdmVyaWZpZWQiOnRydWUsImF0X2hhc2giOiJTeEpKamFKdUZrMHpXNUF6amlVQll3IiwiY19oYXNoIjoiT1ByN2FqYXhibFVqcG4xUENPSmNoUSIsInNjb3BlIjoib3BlbmlkIHByb2ZpbGUgZW1haWwiLCJzaWQiOiI4NmI1NTUzMS1jMmJmLTRiMTAtOWZiYy1lZGMxY2YwOTA5MzYiLCJhdXRoX3RpbWUiOjE2NzE3MjE2OTQsInRpZCI6IjczYmNiNTQyLTYxODktYjIxYS1lMTEzLTJhMGNmYjRjNGFkYyJ9.txThGC0wAm7eMDEQpaUAMUWSncqvCXuR9mjBnDEhT2Q&post_logout_redirect_uri=https%3A%2F%2Flocalhost%3A7075%2Fauthentication%2Flogout-callback&state=aa54fe461a4044a4945d3b6a60c3e571

Responds with:

{ "error" : "invalid_request", "error_description" : "The post_logout_redirect_uri is invalid.", "error_reason" : "invalid_post_logout_redirect_uri" }

But the post logout redirect uri is a copy/paste of what I'm using in my Blazor config and it's https://

Any idea why this is having an issue with the logout?

We've added some documentation about no downtime upgrades in FusionAuth cloud: https://fusionauth.io/docs/v1/tech/installation-guide/cloud#upgrade-duration

If you are self-hosting, we recommend running in a cluster and you should be able to have upgrade downtime similar to what FusionAuth cloud has.

@dan Thanks for the help, I was able to get it working.

If it helps anyone else, my problem was misunderstanding how to properly do custom login/linking. I was trying to get FusionAuth to acquire the authorization code from the third-party provider and then return it to my code, where I would call further api functions. Everything works fine now that I acquire the authorization code directly and pass it to the FusionAuth api calls.

@leandro-menagonzalez So it sounds like you seeing the consents be granted in the Google process, which should make it available in the reconcile lambda, but you are not seeing the value in the reconcile lambda?

https://fusionauth.io/docs/v1/tech/lambdas/google-reconcile

There are two options I'd explore:

Using the OIDC identity provider, which gives you more flexibility and possibly more information. In particular, you get both the access and id token: https://fusionauth.io/docs/v1/tech/lambdas/openid-connect-response-reconcile

Using Lambda HTTP Connect (a paid feature) to make a call to the google APIs to request additional information from within your lambda. You can learn more about that here: https://fusionauth.io/docs/v1/tech/lambdas/#using-lambda-http-connect

Hope that helps.

@suryateja-a16-0 You should be able to add multiple applications to your access token using a JWT populate lambda: https://fusionauth.io/docs/v1/tech/lambdas/jwt-populate

You can examine the user and see all the applications to which they are registered and add those all to the aud claim.

Hope that helps.

@leandro-menagonzalez

It sounds like you want to let users log in with Google, but when they return, be challenged for another factor of authentication?

In general FusionAuth treats identity providers such as google as 'the source of truth' when they are configured. That means FusionAuth trusts that the identity provider has done all the checks they need to do to ensure the user is who they say they are (including MFA). So when FusionAuth gets a successful response from the provider, it won't prompt for anything else.

You could set up step up authentication in your application to force the user to go through MFA: https://fusionauth.io/docs/v1/tech/guides/multi-factor-authentication#step-up-auth

Hope this helps.

@merim-2805

Can you please provide:

what version of FusionAuth you are using an example of the code you are calling to do this action and the response you are seeing what FusionAuth documentation, if any, you're referencing

Thanks!

@impackt Great, glad you have a path forward.

@tashi said in Using native apple sign in:

[SUCCESS]

We found that apple native sign has a way to get the authorization code using their sdk. mcdvoice
ASAuthorizationAppleIDCredential::authorizationCode
We are using that property to pass in the place of code for the api call to api/identity-provider/login.

API: [POST] - api/identity-provider/login

{ "applicationId": "bc3056ab-edb5-42a2-af45-b4f816689997", "data": { "code": "c4cb505812c5343798fa8478cf9c64fa9.0.srzss.wUaW_U9LTn24TjiKdaPKMQ", "redirect_uri": "", "id_token": "eyJraWQiOiJXNldjT0tCIiwiYWxnIjoiUlMyNTYifQ.eyJpc3MiOiJodHRwczovL2FwcGxlaWQuYXBwbGUuY29tIiwiYXVkIjoiY29tLnVyYmFuc2l0dGVyLm1vYmlsZS5sb2NhbCIsImV4cCI6MTY3MDM1MjkzMCwiaWF0IjoxNjcwMjY2NTMwLCJzdWIiOiIwMDE5MjIuYTNkMDZlNjZlMzk5NGM3ZjlmOTE2OTI3NDk4MWYyZTYuMjE0MCIsImNfaGFzaCI6IjJTY1R6YUZySmxKYVU3c2ppNGtiWEEiLCJlbWFpbCI6InRhc2hpLmFicml0aUBnbWFpbC5jb20iLCJlbWFpbF92ZXJpZmllZCI6InRydWUiLCJhdXRoX3RpbWUiOjE2NzAyNjY1MzAsIm5vbmNlX3N1cHBvcnRlZCI6dHJ1ZX0.aVRm7_i1Cn7gyy6NxspZRNta6LaI6knitgGkgIsNkzskxbHXJfMUQbbTE9sYL9xUDpfi-si7sGPRdlvnKCOqtXUKcE0hiHsCOgOQykP1mLrd27qaYiwa__vd9EdWgPYPnujulaI14L1lfvT79Ss_mxOeJiwpsXoy3VI4vRpI7LNHU_QguSD2xFV9ZX-WwOJCzfqFl7dMPOnISYgu1sVjO2couokzlwZEkv96yBQqRByOeeQ0jOVvURJ_FpLuQ2jj0xs5U2S-vvkDStVWuiSiKQIiwons-aHdXAjB__3ASfQamntl1AHCMZWTSaSlh5C1zxSZdH4NQhd-eR4m_wZej" }, "identityProviderId": "13d2a5db-7ef9-4d62-b909-0df58612e775"

RESULT:

{ "refreshToken": "tRbop7_4hhKsdp2XVBLuJwvVWlf030cd2-AzJGQSnY8xLI6THtbVhQ", "refreshTokenId": "28b74a97-4286-4259-bc46-c8857f59fe73", "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImUxMmQxMzQzYSJ9.eyJhdWQiOiJiYzMwNTZhYi1lZGI1LTQyYTItYWY0NS1iNGY4MTY2ODk5OTciLCJleHAiOjE2NzAyNjY2MjYsImlhdCI6MTY3MDI2NjU2NiwiaXNzIjoidXJiYW5zaXR0ZXIubmV0Iiwic3ViIjoiZTRhZTcxZWQtYzEzNy00YmUxLTg2ZDEtMjQ0MTYwNjY3YzBlIiwianRpIjoiZTY3M2U2YmEtODc2Yi00YjY2LTljYjEtNDdjZGVlMzZjNzM3IiwiYXV0aGVudGljYXRpb25UeXBlIjoiQVBQTEUiLCJlbWFpbCI6InRhc2hpLmFicml0aUBnbWFpbC5jb20iLCJlbWFpbF92ZXJpZmllZCI6dHJ1ZSwicHJlZmVycmVkX3VzZXJuYW1lIjoidGFzaGktYmh1dGlhIiwiYXBwbGljYXRpb25JZCI6ImJjMzA1NmFiLWVkYjUtNDJhMi1hZjQ1LWI0ZjgxNjY4OTk5NyIsInJvbGVzIjpbXSwic2lkIjoiMjhiNzRhOTctNDI4Ni00MjU5LWJjNDYtYzg4NTdmNTlmZTczIiwiYXV0aF90aW1lIjoxNjcwMjY2NTY2LCJ0aWQiOiJmMmM0OTQ3Ni1hNzdhLThmZDItZDQxZC0wMjA2ODA3NjNlZDQiLCJkYXRhIjp7ImlkIjoiMTExMTM5NiIsInJvbGVzIjpbIjUiXX0sImN1c3RvbSI6ImN1c3RvbSJ9.BCGm0b1GHTPKuQRi0VrhqxPX6kGOB-rwkkkuYn3gkm", "tokenExpirationInstant": 1670266626871, "user": { "active": true, "connectorId": "e3306678-a53a-4964-9040-1c96f36dda72", "data": { "id": "1111396", "roles": [ "5" ] }, "email": "janesmith11223344@gmail.com", "fullName": "null null", "id": "e4ae71ed-c137-4be1-86d1-244160667c0e", "imageUrl": "https://assets-local.urbansitter.net/assets/img/us-default-avatar-320.png", "insertInstant": 1669939131457, "lastLoginInstant": 1670266566856, "lastUpdateInstant": 1670266566856, "memberships": [], "passwordChangeRequired": false, "passwordLastUpdateInstant": 1669939131538, "preferredLanguages": [], "registrations": [ { "applicationId": "bc3056ab-edb5-42a2-af45-b4f816689997", "data": {}, "id": "c1ed7f48-f29c-483b-a3a4-381c834327a4", "insertInstant": 1669939131544, "lastLoginInstant": 1670266566856, "lastUpdateInstant": 1670266566860, "preferredLanguages": [], "roles": [], "tokens": {}, "username": "jane-smith", "usernameStatus": "ACTIVE", "verified": true } ], "tenantId": "f2c49476-a77a-8fd2-d41d-020680763ed4", "twoFactor": { "methods": [], "recoveryCodes": [] }, "uniqueUsername": "jane-smith", "username": "jane-smith", "usernameStatus": "ACTIVE", "verified": true } }

Thanks for all the help.

Very helpful and informative. Thank for sharing this post.

@paul-fink marking this thread as being addressed out of this forum band.

-Josh

@david-moreno

Is this still an open issue for you? If so, including the debug information (and turning on debug for the SAML IdP can be helpful) as you complete the SAML handshake.

Josh

@leandro-menagonzalez Sorry - I was traveling for a bit and then under the weather.

Were you able to resolve this?

If not, my understanding is that this would be a mapping problem. Essentially, Google would have to be instructed to send over a profile pic url, and FusionAuth would consume that in the AuthN response. Further, a reconcile lambda can be used to grab this URL attribute and store on the user, etc. Let me know if I am misunderstanding the issue.

Josh

@dan said in I really want a client library for <language X>:

All of our client libraries are open source (Apache2 license). At present we use this open source project to build them.

If you are interested in support for a language (let's say Lisp, because it's so cool 🙂 ), then take the following steps:

Search our github issues to make sure there isn't already a request (see C++ and Elixir). If there is an issue present, vote for it. If not, add one.

If you want to take a crack at building the Lisp library, please file an issue as above and indicate your desire to help. How it works:

We start with a JSON DSL to define each API ( https://github.com/FusionAuth/fusionauth-client-builder/tree/master/src/main/api ). We then build the code using a template, for example, here is the ruby template : https://github.com/FusionAuth/fusionauth-client-builder/blob/master/src/main/client/ruby.client.ftl This ruby template then produces the ruby client: https://github.com/FusionAuth/fusionauth-ruby-client / https://github.com/FusionAuth/fusionauth-ruby-client/blob/master/lib/fusionauth/fusionauth_client.rb So for Lisp, find the language most like it and then copy the client template (here's Ruby's), copy it to lisp.client.ftl and start hacking on it. This lets us keep the Lisp client library current for each of the API calls and we can build a new client each time we release. I use these libraries all the time, thanks. But I'm still not up to the task. I'm still getting in the way of this crazy college thing. It's good that there is an essay service they help me quickly, but not for free, although they have 24/7 support.

I use these libraries all the time, thank you

If you want to use FusionAuth to secure access to an application (running in Docker or elsewhere) that doesn't have any security, you can use a proxy to do so.

The proxy sits in front of the application and all traffic should go through it. When it sees an unauthenticated user, it forwards that user to FusionAuth, where the user logs in and generates a token. Then the user is forwarded back to the proxy. The token is parsed by the proxy and if the token is valid the user gets access.

This can be done in concert with any proxy that supports JWTs and OIDC.

I've heard of this being done with HAProxy and Kong. Here's an HAProxy tutorial. Here's a Kong tutorial. Here are instructions on how to do this with ngrok cloud edge, which may be useful for the overall flow even if you don't use that software: https://fusionauth.io/docs/v1/tech/developer-guide/api-gateways/ngrok-cloud-edge

Hope that helps.

Hmmm. I'm not quite sure what is going on. Have you been able to debug this?

@atakan , you wrote the linked forum post, did you run into this?

FusionAuth doesn't use a local mail queue at all. It connects to whatever mail server you have set up at the tenant level.

Here are some troubleshooting tips to try: https://fusionauth.io/docs/v1/tech/admin-guide/troubleshooting#troubleshooting-email

@quent We have a list of typical cookies set by the hosted login pages here: https://fusionauth.io/docs/v1/tech/reference/cookies