even if I do this, the user is still in login state for other platform, the bug seems to be because of redis implementation as the token and sessions are not removed from redis. Could you help me on this.. When do we use redis and when not. I have call the delete-session api
Hi, is there a way to delete all the active user session/ token to logout user when user changes/update the password, both by self and/or admin. The problem here is within an organization there are multiple application in which user might be logged in. And it could be either in multiple web browser or mobile ( android, ios). Is there something similar to SSO logout
Yes, when I configured recaptcha v3 using site key and site secret it is showing issue :-
domain list are same as when configured for v2
Didn't casdoor support v3 reCaptcha ?
Tried with Auth.com and it is providing the name as ( user defined during authorization consent page)
In my opinion, the issue lies in GetUserInfo function of goth.go. Will debug further.
If you are pointing out to Google SSO then yes it is populating the name.
I have added apple as an oauth provider and I am able to sign up/ sign in with apple but the user information "name" is not getting synced with casdoor. Even when a user provide consent for name and email. How can I get the name attribute of user?
Fixed it by manually inserting private key into table which required to preserve the original private key format i.e it should contain new line parameter, from UI these new line got changed into white space which was resulting invalidation of private key.
Hi, while setting up sign in with apple , I am getting** invalid private key**.. I have tried pasted my private key as it is after downloading, removed spaces and new line in other to have a single line but none of it worked. How could I resolve this issue ? Any insight you can provide will be much more helpful. Thanks in advance
What other distinguish feature do we have in enterprise version?
Won't it be available in Open source ?
Also, I am planning to switch to enterprise version once our user base crosses 50k active user, currently we are at 10k. So, my concern here is how less of a hassle it would be to migrate data and what extra features are there that makes enterprise version stand out from other IAM solution like Keycloak and Oauth? This would really help me moving forward.
Password Policy Management
- Admin to enforce user to password reset.
- Password Validity Period Configurable.
- Functionality to flag user to update password during password reset by admin.
May be I got you confused a little, I am saying that a google signed in user now can login (generate a token) without using any password but just an email via requesting to "/api/login/oauth/access_token".
I have created a user via google sign up process, so as expected the user will not have any password set. But I am able to generate a access token using rest API call to "/api/login/oauth/access_token" for the same user without presenting any password. When I check, it is possible because in application . I have Grant Types as Password along with Authorization Code , Refresh Token etc. When I remove the Password from Grant Type, it restrict me saying "grant_type: password is not supported in this application". Is this an expected behavior? Is it possible to restrict this with other approaches ? Should we have an restriction in applications for grant types where password and authorization code couldn't be selected together? Please let me know if I am configuring it in wrong way. @hsluoyz
not so sure, but may be make use a 3rd party logins of user and filter it with the Provider enabled in Application. Do you have any suggestions?
Since user will be using a google sign-in, there is no problem of login but the same email can be used via user/password flow, which shows the error message saying "password or code is incorrect, you have 4 remaining chances". The issue here seems to be lack of distinguishing user as Oauth Provider User or general user/password user in Casdoor. I am not sure if this is a correct approach to take. Will it make sense to auto detect the users email and pop up the respectives third party enable or link for the users?
while signing up using google a new account gets created, now when I use a default user/password flow for the same user, how should I distinguish it as a Provider user instead of default password user? I am getting the invalid credentials as the password itself doesn't exist. But casdoor is still checking its password and adding retry count as user email is same. How do we handle such case and prompt a user friendly message.
Thank you for the response but What I want is to enable MFA only to those user who use the User/Password as login method in my application, For example Lets say that I have enable google login in one of my application, which use a User/password login as a default login. Whenever a user attempt to login using Username/password flow I want to enforce them to go through MFA flow as well. But while using a google login flow I don't want to enforce them with MFA. Hope this clear my requirement.
Hi , Is it possible to enable Google login specific to an application in an organization? Also, while enabling MFA is there a way to by pass it when a user initiate login via a Google?
Isn't there other way around ?
Hi, I have to host my application in three different platform Web, Android and IOS mobile. I need to enable login from google using Oauth. For this I have setup a google provider. When I use this flow in Android and IOS I hit the token expiration and get logout from android and IOS. How do I keep my session running in Andriodi and IOS? Currently I am using Android SDK and retrieving Access token. Is this a correct way to implment?
Could you please redirect me to the correct documentation link
Hi, I am new to the Casdoor, Is there any document where I can find how does an enforcer enforces the configured model with policy rule? And how does these permission and policies take effect during user login ? will it be by-default enforce by casdoor or do we have to make some initialization using casbin? Also, how can we use a enforce defined by casdoor in casbin? any example or document is highly appreciated. Thanks in Advance.
I see that in User table we have a field call properties, so during a sign up how can I map certain fields and its value to it? Please your help is fully appreciated . I am new to GO and Casdoor.
But I wanted to add the field that don't exist in User. I could see that I can add other nonfields like workspace and all in Token Fields but how do I populate it with the values, is there any kind of mapper like the one exists in keycloak
My scenario here is I have a abstraction UI call Workspace where the user perform various tasks. A user can be a admin/member of the workspace and a user can have multiple workspace where he/she could be a admin in one and member in other. How could I handle such using Casdoor and give a restrictive view when user login?
if I need a custom fields in JWT token how can I add them and fill them up
