FusionAuth
    • Home
    • Categories
    • Recent
    • Popular
    • Pricing
    • Contact us
    • Docs
    • Login
    1. Home
    2. Categories
    3. Q&A
    Log in to post
    Load new posts
    • Recently Replied
    • Recently Created
    • Most Posts
    • Most Votes
    • Most Views
    • R

      Registration email is not sent

      registration • • ryan.raasch
      4
      0
      Votes
      4
      Posts
      1.8k
      Views

      I

      Hi, I have the same problem here. The tenant's SMTP setting are correct and test emails are successfully delivered. I'm evaluating the FusionAuth right now and often delete/re-register users with the same emails. Verification emails are delivered to all users but one. The only thing that distinguish the problem user from the others is the fact I initially registered him via Facebook identity provider, so his email was automatically verified. After that I deleted the user and trying to register with just email (not Facebook). And emails are not delivered. Manually sent SMTP test emails to that address also delivered successfully. I hope this help to investigate.

    • danD

      Can I get the OAuth/OIDC endpoints for an application via the API?

      oauth oidc endpoint api • • dan
      2
      0
      Votes
      2
      Posts
      2.1k
      Views

      danD

      These are generated in the UI. So the values are not available from the API.

      However you can derive them yourself as well. We just take the URL + /oauth2/authorize?... + redirect_uri etc.

    • M

      Clarification on OAuth/OIDC logout endpoint

      oauth oidc logout • • Moonshine
      4
      0
      Votes
      4
      Posts
      4.1k
      Views

      M

      Yea, that flexibility would be ideal IMO, although the registeredLogoutURLs should be workable for us at this point. FWIW that is actually the behavior I assumed before digging into the docs. I'll definitely add the issue to GitHub, as I think it's probably part of the path to getting OIDC Certification which appears to already have an issue.

      Thanks!

    • danD

      Retrieving all users

      users api search • • dan
      2
      0
      Votes
      2
      Posts
      2.0k
      Views

      danD

      From the user search docs, for the database search engine:

      Regular expressions may not be used. A value of * will match all records.

      For the elasticsearch search engine, you are limited to 10,000 records returned due to this bug: https://github.com/FusionAuth/fusionauth-issues/issues/494

      Here's docs on how to switch between them: https://fusionauth.io/docs/v1/tech/tutorials/switch-search-engines

    • danD

      Limit on tenants

      tenants limits • • dan
      2
      0
      Votes
      2
      Posts
      1.4k
      Views

      danD

      No hard limits, we have some clients running somewhere between 5-10k.

      If you encounter any performance degradation, you can open a GitHub issue and we will take a look. We do have some work in plan to improve the UI for this type of scale.

    • B

      Facebook Provider doesn't support Scopes?

      • • brian
      2
      0
      Votes
      2
      Posts
      260
      Views

      danD

      I haven't implemented this identity provider myself, but from the documentation:

      https://fusionauth.io/docs/v1/tech/identity-providers/facebook https://developers.facebook.com/docs/facebook-login/permissions/overview

      It appears that 'permissions' are what facebook uses to mean 'scopes'. You ask for a permission of email or user_likes, for example.

      Have you tried to put in the scope you want into the permissions field and tested it out?

      For anyone reading this in the future, here's a list of the permissions that you can use: https://developers.facebook.com/docs/permissions/reference/

      Note that it says:

      Every permission below requires App Review, except: email, pages_show_list.

    • S

      "PUT api/user/verify-email?email={email}&sendVerifyEmail=true" returns the empty body

      • • Ssong
      4
      0
      Votes
      4
      Posts
      698
      Views

      danD

      Hiya,

      So here's what I did.

      I made sure that email verification was enabled at the tenant level. "Tenants -> Your Tenant -> Email -> Email Verification Settings".

      Then I ran the following curl scripts (where API_KEY is a valid FusionAuth API key) to mark the email of a user verified.

      # create the user curl -XPOST -H'Content-type:application/json' -H "Authorization: $API_KEY" 'http://localhost:9011/api/user' -d '{"user" : { "email" : "testverify4@example.com" , "password" :"password", "verified" : false }}' # ask for a new verification id, but don't send the email--assume you send the email in some other way. curl -XPUT -H "Authorization: $API_KEY" 'http://localhost:9011/api/user/verify-email?email=testverify4@example.com&sendVerifyEmail=false' # This sends back: # {"verificationId":"nBm3HvfI1fAgilLk2Hj06gXeYuidhRM25tPECtbpqMM"} # GET the user to make sure they still have email verified of false curl -XGET -H "Authorization: $API_KEY" 'http://localhost:9011/api/user/552bdd9a-2655-433c-a91d-7002e730b385' # post to verify the user's email address curl -XPOST -H "Authorization: $API_KEY" 'http://localhost:9011/api/user/verify-email/nBm3HvfI1fAgilLk2Hj06gXeYuidhRM25tPECtbpqMM' # GET the user to verify that the email address has been marked verified. curl -XGET -H "Authorization: $API_KEY" 'http://localhost:9011/api/user/552bdd9a-2655-433c-a91d-7002e730b385'

      Does this flow help?

      Also, remember that there is registration email verification and user email verification, and the APIs are different. I believe, from what you wrote, that you are trying to get user email verification (that's the APIs you are using, except that the first post talks about verifying a registration); please correct me if I'm wrong.

    • danD

      Are refresh tokens globally unique?

      refresh token • • dan
      2
      0
      Votes
      2
      Posts
      2.7k
      Views

      danD

      They are globally unique, and they are deleted when a user is deleted. They must belong to a user.

    • danD

      Time drift with OTP

      two factor time skew • • dan
      2
      0
      Votes
      2
      Posts
      1.5k
      Views

      danD

      The code is considered valid for n -1, n and n + 1 time steps. We use a 30s time step, so I think this would max out at 59s for a skew tolerance. In your case, if you have up to 70s of skew, this would plausibly break TOTP 2FA.

    • danD

      I'm a customer, how do I open a support ticket?

      • • dan
      2
      0
      Votes
      2
      Posts
      598
      Views

      danD

      If you are on one of the editions that offer support with a guaranteed response time (more on those options here), the best way to file a ticket is to login to https://account.fusionauth.io and go to the support section. You'll see a way to submit a ticket, which will be routed to the appropriate team member.

    • danD

      Can I delete the default tenant?

      default tenant delete • • dan
      2
      0
      Votes
      2
      Posts
      725
      Views

      danD

      Unfortunately the default tenant contains the FusionAuth application and so it cannot be deleted, short of dropping and recreating the entire FusionAuth database.

    • danD

      Do user ids have to be different between tenants?

      tenants user ids uniqueness • • dan
      2
      0
      Votes
      2
      Posts
      1.5k
      Views

      danD

      User ids need to be globally unique. You can either provide your own unique uuid or you can let FusionAuth provide them for you. But these values are not tenant scoped.

    • V

      Why after a SAML authentication I have an "auth code not found" error?

      • • viola.mauro
      11
      0
      Votes
      11
      Posts
      4.9k
      Views

      danD

      Ah, that's great! I've definitely made my share of mistakes, no worries!

    • F

      Malformed request when using idp_hint

      • • fusionauth_user
      7
      0
      Votes
      7
      Posts
      7.3k
      Views

      danD

      Great. I've updated the documentation to reflect that google and facebook aren't supported; that'll be published next week. Sorry about that.

      More details on the bug I filed above (and the doc change linked in the bug). If you try this with SAML/OIDC and it fails, please let me know.

    • danD

      Testing loading of large numbers of users

      migration import testing • • dan
      2
      0
      Votes
      2
      Posts
      2.1k
      Views

      danD

      Options:

      You can drop the database. This will work if you want to start with a clean slate every time. You may want to look into kickstart or terraform to set default applications, accounts, and other items up every time. You can load all the users into a tenant (not the default one). Then, when you are done with loading up the users and want to clean up, you can delete the tenant, which will remove all users associated with that tenant. This option maintains all the other non tenant settings (IdPs, emails templates, themes, etc). You can use the bulk delete API. You can start deleting blocks of 5-10k users and increase the number deleted with each API call. This will be slower, but has the benefit of leaving the rest of the system untouched.
    • S

      How long does the email template changePasswordId id last before it expires? How can invitation expiration be implemented?

      • • stephen
      5
      1
      Votes
      5
      Posts
      1.3k
      Views

      S

      Added a feature request for this issue: https://github.com/FusionAuth/fusionauth-issues/issues/904

    • danD

      Do password rules apply to existing users?

      password rules complexity existing users • • dan
      2
      0
      Votes
      2
      Posts
      654
      Views

      danD

      The rules apply only when they change their password in the future.

      We don't have any way of knowing the user's current password.

      You can, of course, force the user to change their password, and then the new password rules would apply. You can do this in the admin ui or via updating the passwordChangeRequired field in the user object via the API.

    • danD

      Stacktrace when visiting a URL with weird characters

      tomcat stack trace logging error • • dan
      2
      0
      Votes
      2
      Posts
      2.3k
      Views

      danD

      In 1.19.5, we handle most of these cases by configuring tomcat to allow certain characters to be unescaped in the URL.

      https://github.com/FusionAuth/fusionauth-issues/issues/635

      So an upgrade is the most straightforward way to handle this.

      If you are proxying FusionAuth (behind something like nginx) you could also capture and hide any 500 errors: https://stackoverflow.com/questions/8715064/nginx-not-serving-my-error-page/8715597#8715597.

    • S

      Is there a way to send the user to the hosted signup or login form when opening?

      • • shanon
      4
      0
      Votes
      4
      Posts
      6.6k
      Views

      S

      Ok, thanks @dan and @robotdan ! I think a combination of both your responses gets me what I need. Much appreciated!

    • F

      How do i test idp login?

      • • fusionauth_user
      2
      0
      Votes
      2
      Posts
      2.8k
      Views

      danD

      I would do one of two things:

      consult the google docs about what is returned create a lambda to write the idToken json object provided by google to the event log, then login and view the event log to see what is provided.

      More on the google reconcile lambda here: https://fusionauth.io/docs/v1/tech/lambdas/google-reconcile