Comments (25)
A patch is coming out today that will allow this use case to work.
from fusionauth-issues.
This should work for you again in version 1.17.2
from fusionauth-issues.
Can you please update the LinkedIn changes also?
from fusionauth-issues.
@joydeb28 did you try the above configuration?
from fusionauth-issues.
Yes. I am getting "A request to the OpenID Connect Token API has failed. Unable to complete this login request." at the time of login.
from fusionauth-issues.
If you enable debug on the OpenID Connect IdP configuration what is in the debug event log? (System > Event Log)
from fusionauth-issues.
Event Logs:
Request to the [https://www.linkedin.com/oauth/v2/accessToken] endpoint failed. Status code [400]
Error response is
{
"error" : "invalid_request",
"error_description" : "A required parameter "client_secret" is missing"
}
from fusionauth-issues.
I think LinkedIn is looking for the client_secret
in the request body.
https://docs.microsoft.com/en-us/linkedin/shared/authentication/authorization-code-flow?context=linkedin/consumer/context
So in your OpenID Connect IdP config, change Client Authentication method from "HTTP basic authentication" to "Request body".
from fusionauth-issues.
I changed the Client authentication method to "client_secret_post" and it worked. I got the token.
But getting the below error.
{
"elements" : [ {
"handle~" : {
"emailAddress" : "[email protected]"
},
"handle" : "urn:li:emailAddress:655618093"
} ]
}
6/16/2020 06:31:03 PM GMT The identity provider was unable to reconcile the email address. An email address is required to complete this request.
from fusionauth-issues.
I added the reconcile lambda as you mentioned. But the above error I am getting now.
from fusionauth-issues.
Dump the contents of the incoming jwt
to see what is in it, and then adjust your lambda accordingly.
Example:
function reconcile(user, registration, jwt) {
console.debug(jwt, null, 2);
//user.email = jwt.elements[0]['handle~'].emailAddress;
}
It could be the example Lambda above is not longer correct.
from fusionauth-issues.
In the Event logs, I am getting only this.
{
"elements" : [ {
"handle~" : {
"emailAddress" : "[email protected]"
},
"handle" : "urn:li:emailAddress:655618093"
} ]
}
from fusionauth-issues.
Ok, so the lambda looks correct. This "hack" used to work, I think a change we made in 1.17.0 may have broken that.
If I am correct, it will work on 1.16.0, but not 1.17.0.
We'd either have to fully support a LinkedIn login option, or add another configuration option to allow a reconcile lambda to override the user.email
field.
from fusionauth-issues.
For now any suggestion to make it ready?
from fusionauth-issues.
No work around at the moment.
We've discuss removing this limitation on the lambda, and allowing it to set the user.email
field and just add a warning to the Lambda configuration indicating the risks.
from fusionauth-issues.
Thanks for this quick fix.
from fusionauth-issues.
@joydeb28 let me know if it works for you, there may be an edge case yet where this may not work as you'd like.
from fusionauth-issues.
@robotdan
Not working, still the same problem.
from fusionauth-issues.
@joydeb28 once version 1.17.3 is available, you should be able to make LinkedIn work again. I updated the comments for the workaround in the main description above.
The configuration will have a new field for Email claim which will default to email
. For LinkedIn you'll be able to set it to elements/0/handle~0/emailAddress
.
from fusionauth-issues.
Thanks @robotdan
It's working, now I am getting the email.
I set scope=r_liteprofile%20r_emailaddress%20w_member_social
but I'm not getting the profile details.
from fusionauth-issues.
@robotdan
Can you please help me to get the full profile?
from fusionauth-issues.
You'll have to use the Microsoft documentation to identify the correct scope or URL to use.
https://docs.microsoft.com/en-us/linkedin/shared/authentication/authorization-code-flow?context=linkedin/consumer/context
from fusionauth-issues.
@robotdan I'm trying to add login with LinkedIn, the above settings will only query for email address since the userinfo endpoint is https://api.linkedin.com/v2/emailAddress?q=members&projection=(elements*(handle~)) and not for profile information such as first name and last name but for profile information the userinfo endpoint should be set as https://api.linkedin.com/v2/me , how to basically query for endpoint which will return both the profile information and email address. The above configuration only adds email address.
https://docs.microsoft.com/en-us/linkedin/shared/integrations/people/profile-api
from fusionauth-issues.
Hi @robotdan did you get a chance to review this
from fusionauth-issues.
It's happening... :-)
from fusionauth-issues.
Related Issues (20)
- Given an entity, add the ability to search for all entities that it has a grant to
- Investigate Client Authentication for the Device Authorize Endpoint
- Send event logs directly to Azure Log Analytics Workspace (LAW)
- Add "Global Audit" FusionAuth role
- Update certificate tool tip in webhooks and doc to clarify use case
- [Bug]: Logout doesn't seem to work properly
- XSS Vuln: HTML Email Templates Don't Auto-escape
- Issue creating an entity when there is more than one tenant and I don't select a tenant
- Offer a guided onboarding experience when starting FusionAuth HOT 2
- Clicking "discover endpoints" 4 times in rapid succession on the OIDC identity provider creates broken UX
- [Bug]: Creating a Google Identity Provider and then hitting back and save again causes a 500 error
- Fix fonts and styles on direct-downloads
- Application SMS template help popup text is for email field
- Improve error handling for the SAML login endpoint when the caller is missing a `Content-Type` request header HOT 2
- Restrict the access granted to third party applications HOT 1
- Allow for expansion of application roles and scopes in application search results HOT 2
- Require `aud` claim on OpenID Connect UserInfo endpoint HOT 2
- Update deps for 1.52.0
- Update deps for 1.51.0 HOT 1
- [Bug]: SMS Two Factor messages will always use the template configured on the tenant even if an application-level template is configured.
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from fusionauth-issues.