Custom registration fields for 3rd party identity provider users inconsistently disappear, requiring existing users to provide them again

[tomzorz]

Custom registration fields inconsistently disappear, requiring existing users to provide them again

Description

We have a FA setup (hosted by FA), where we have 2 extra fields and a custom registration form. These 2 fields seem to occasionally lose their data - seemingly only for users that use a 3rd party identity provider to sign in. This then causes these users to be redirected to the registration form, to fill out these fields again.. which then leads to confusion / churn.

Affects versions

1.46.0 (but affects all versions we've seen)

Steps to reproduce

• Create extra field in customizations
• Add said field to a custom registration form
• Add a 3rd party identity provider (we only have google, so it might be google specific? but unlikely)
• use that identity provider to sign up
• ... ?
• observe registration custom field data missing after some time...

Expected behavior

Custom field data doesn't disappear.

Screenshots

N/A

Platform

• Device: desktop, phone
• OS: windows, mac, ios
• Browser + version: latest any, immaterial
• Database: hosted by you, AWS RDS I imagine?

Community guidelines

All issues filed in this repository must abide by the FusionAuth community guidelines.

Additional context

I sadly haven't figured out how to reproduce this consistently, I'm happy to provide specific info from our instance, e.g. usernames where we've got reports from to assist in debugging.

We've looked at the same user after re-providing the fields, they are in the registration... and then we've seen the same user later with the data gone.

[mooreds]

A few more qs, @tomzorz...

• Do you have any lambdas? What parts of the login flow are they associated with?
• Are you creating a registration within FusionAuth for users who log in with the Google identity provider?
• what is the type of registration field (required, but what data type)?
• Do you have one application users are logging into, or multiple (in the FusionAuth Application sense)?

[tomzorz]

Do you have any lambdas? What parts of the login flow are they associated with?

We do not.

Are you creating a registration within FusionAuth for users who log in with the Google identity provider?

Correct, for an app within the instance.

What is the type of registration field (required, but what data type)?

1. registration.data.company - Control Text; Type: String; Required: yes
2. registration.data.role - Control Select; Type: String; Required: yes

Do you have one application users are logging into, or multiple (in the FusionAuth Application sense)?

Originally only one - we now (very recently) have more but the issue existed well before this was the case. We have a test/prod tenant, and test/prod app versions - it happens on all of them as far as I can tell.

[mooreds]

Thanks @tomzorz . We'll try to recreate.

[tomzorz]

I just looked at a user in our instance who keeps experiencing this issue - their registration data is gone again, despite filling it out a few days ago (I even got a screenshot from them saying they had to fill it out again). I can provide info about our instance / user if that helps debugging.

[robotdan]

Possibly related or similar to this issue that was fixed in 1.46.0.

• Nested user data not persisted in advanced registration form #2239

[mooreds]

Thanks for the additional detail @tomzorz . We're in the middle of some other things but will get to triaging this next week. If you end up with consistent repro steps, that'd be helpful. We will test against 1.47.1 and 1.46.0 and see if I can recreate in either (or both).

[tomzorz]

Possibly related or similar to this issue that was fixed in 1.46.0.

• Nested user data not persisted in advanced registration form #2239

FWIW we don't have any fields on the users, only on registrations

[mooreds]

@tomzorz hiya, I was unable to recreate this locally. I was using 1.47.1.

Do you have any other external processes which update the user or registration fields?

Here's my configuration for my Google Identity Provider (minus the client id/secret) and registration forms.

Can you please share how mine differs from yours, if it does?

[tomzorz]

Ours looks exactly the same.

We don't have any other code that alters the registration fields, from our-end we pretty much use the API as read-only.

But even right now... I see a user that has 2 application registrations - both registrations use the same form, and one has the reg data in it, the other doesn't.

One

Two

And yet to get to this point, both should have the fields.

[mooreds]

Hmmm. So to recap:

• you have an application which uses authentication tokens (don't know if that is important, but may be)
• the application has self service registration enabled
• there are two required custom registration data fields on a custom registration form
• the custom registration form is enabled for the application (or more than one, but you were seeing this behavior before you had two applications)
• the user logs in initially via google and is asked to fill out the two additional form fields
• the user then logs in later with google and proceeds normally
• at some point in the future, for some set of users, the data in the registration is 'zeroed' out. at next login, the user has to fill out the two additional form fields

Additional points:

• occurs on 1.46
• single node server (not a cluster)
• no external operations affect this
• it is not easily replicable but happens for a non-zero number of users
• no lambdas on your side that might do this
• the google identity provider debug is off

Additional qs:

• is there any pattern to the users that it is happening to, other than that they are all using google SSO to sign in? (Same time of day, always gmail users vs google work users, occurs more for users who have are registered to two different applications, etc)
• Do you have any transactional webhooks that might interfere with a registration?
• Have you considered adding this webhook for logging more details?
• Do users who log in with google ever log in with passwords or authentication tokens afterwards? So maybe they register with google the first time, but then use another method of logging in?

I will set this up with 1.46 to try to replicate locally again. Will also set up authentication tokens.

[tomzorz]

All of the facts above are correct as stated.

is there any pattern to the users that it is happening to, other than that they are all using google SSO to sign in? (Same time of day, always gmail users vs google work users, occurs more for users who have are registered to two different applications, etc)

We haven't noticed anything. The one user I keep bringing up is a personal gmail account, and I have seen it happen to other personal gmails. I just asked around in our team, and some say they've seen this happen to regular sign-ups, not just "log in with google" ones - so maybe it is unrelated to google login?

Do you have any transactional webhooks that might interfere with a registration?

We don't. We have webhooks enabled for a large selection of events, but we pretty much just log the event and don't do anything with it.

Have you considered adding this webhook for logging more details?

We have it enabled, I think we have all user.* webhooks enabled. I did a quick search in our logs, and I see many user.registration.create events, some having that registration data in them, some don't. I do not see any .update or .update.complete events, at least recently.

Do users who log in with google ever log in with passwords or authentication tokens afterwards? So maybe they register with google the first time, but then use another method of logging in?

Some do, but it's really rare - the user where I know often happens definitely doesn't do that.

[mooreds]

@tomzorz I still haven't recreated, sorry. Is this still an issue? Have you found any other details to share about what circumstances cause it to surface.

[tomzorz]

Issue is still around, still haven't seen a better way to repro it though consistently :(