Application webhooks not firing

[trollr]

Application webhooks not firing

Description

If you create a webhook user.create for all applications an event will be sent. However if you select only one application nothing happend

Steps to reproduce

Steps to reproduce the behavior:

1. Go to 'Settings->Webhook'
2. Create a webhook for user.created event
3. Goto Settings->webhooks->applications and select only one application
4. Goto Applications an activate the webhook
5. Register a new user for the selected application
6. No event fired

Expected behavior

I would expect that the webhook is triggered, if you register a new user for the selected application

Related or Duplicate

#930

Platform

• OS: Docker container
• Chrome 74.0.3729.131

[robotdan]

Hi @trollr thanks for opening this issue.

In step 5 of your reproduce, you register a new user. If you're only creating a new registration for an existing user you will not see the user.create event be fired, but you should see the user.registration.create event. This event was added in version 1.6.0.

Let me know if I've misunderstood your recreate steps.

[trollr]

Hi @robotdan,

I registered a new (not known) user with the registration form of the created application (company). Tried user.registration.create as well but nothing happend :(

Webhook config:

Application config:

Important information: The webhook test works, so it seems that the event is not triggered from fusionAuth. Btw its fusionAuth version 1.6.1

[robotdan]

Can you also ensure the events are enabled globally?

See Settings --> System --> Webhooks

[trollr]

Yes the events are enabled globally

Should I see something in the event log or can I increase the log level to get some more informations?

[robotdan]

With the transaction setting you have, FusionAuth won't fail if the webhook isn't working. For a test, can you change the transaction setting to require each webhook to succeed and see if you get a different status code back on the API request? If we fail based upon the transaction setting, you should get a 504.

You can also try modifying your webhook configuration, toggle "All Applications" in the Applications tab.

Updated: I think I've found the issue, the workaround will be to select "All applications" for the webhook.

This configuration is somewhat confusing, one option going forward will be to remove the application configuration. This means that you would enable the events and you'll receive all events of that type regardless of the application (if applicable).

This change would mean that you'll need to review the applicationId in the event to see if you wish to process the event instead of having FusionAuth filter the event for you.

Another option is to send all events if they are not application specific, and then if you specified an application and the event is application specific, then you will only receive events for that application.

[trollr]

Ok, I'll use the applicationId workaround as long as this bug isn't fixed

[voidmain]

Hi @trollr. One questions for you on this item:

We have been discussing removing the "Applications" tab on the Webhook configuration pages. This configuration seems to cause quite a bit of confusion and it doesn't make sense for all of the event types. Additionally, the events that are application specific will send the application id(s) in the JSON to the Webhook. This would allow you to handle application specifics in the Webhooks.

Let me know your thoughts on that so we can determine if we should remove that configuration.

[trollr]

I think it's a common feature to select events for a single application for multiple reasons especially to reduce the workload on my services. Your suggested solution will work, but it's more complicated for developers, because they need to inject the applicationId in their services (eg. staging, prod, dev, local etc).

I would suggest to split hooks into two scopes. The ones for global purposes which will be configured in the system settings and last but not least the ones for the applications which will be configured in the application itself instead to just enable them.

For sure that's a way more work for you. However if you encapsulate the events maybe it'll be possible to add custom events on my own eg in my plugins.

Note: Thereby you can understand my use case: I have two applications company and employee. Both of them use the user.create hook to send emails to the users. And Both of them will be notified, although only my company service should be notified if some registered as company user.

[robotdan]

Thanks for that detail and feedback @trollr that is very helpful.

[marv4208]

@robotdan - just posting on this issue. We would also like to see webhooks enabled at the application level. The admin UI shows this as a configuration option but it does not work. We have to use the enable "all applications" configuration in the webhook, which makes this an all or nothing setting. Will you be able to prioritize this issue on your roadmap?

[robotdan]

The configuration works, but it is confusing and sort of a legacy configuration. There are a few event types that are of type "Application" and these events can optionally only be sent to one application.

The events that are considered "application" events (currently) and can be scoped to an application based up the Webhook config: user.action, jwt.refresh-token.revoke and jwt.refresh, jwt.public-key.update.

We could look at re-working this to make it actually per application. In practice there are more "user" events as their are application scoped events.

For example, the user.delete, user.create, user.update, user.deactivate, user.bulk.create, user.reactivate, jwt.public-key.update, user.email.verified and user.password.breach are all non-application specific.

And the user.login.success and user.login.failed may or may not be related to an application scoped event.

The user.registration.create , user.registration.update, user.registration.delete and user.registration.verified and user.action (sometimes) are application scoped.

Any input is welcome, if you had your ideal, how would this be configured to allow a "per application" configuration?

Because all applications belong to a single tenant, and a user is scoped to a tenant, most of the events apply to the tenant, and not to an application.

[marv4208]

@robotdan thank you for the thoughtful and detailed response. In our case we set up a dedicated tenant and application for each of our application environments. For example foo.com we would setup foo-prod tenant > foo-prod app
foo-test tenant > foo-test app
foo-dev tenant > foo-dev app

We need the webhook to respect application-level events so that we can configure the webhook to send to a configured endpoint.

webhook for prod - endpoint: https://api.foo.com/customer/fusionauth/webhook
webhook for test - endpoint: https://api-test-foo.com/customer/fusionauth/webhook
webhook for dev - endpoint: https://api-dev-foo.com/customer/fusionauth/webhook

In the example above the applications are configured in FusionAuth as dedicated environment tenants and applications, but when we configure the webhook to only the application, it does not fire on the event. When we use the "All application" setting the webhook fires but the POST sends data to all of our environment endpoints */customer/fusionauth/webhook regardless of what application triggered the event.

[robotdan]

@mv4208 thanks , that use case is helpful.

In your particular case if you could assign a webhook to a tenant I think this would satisfy your requirement?

This way you'd create 3 webhooks, and 3 tenants with a one to one relationship.

[marv4208]

@robotdan - yes, that would be perfect for our requirements!

[sinqinc]

@robotdan thank you for the thoughtful and detailed response. In our case we set up a dedicated tenant and application for each of our application environments. For example foo.com we would setup foo-prod tenant > foo-prod app
foo-test tenant > foo-test app
foo-dev tenant > foo-dev app

We need the webhook to respect application-level events so that we can configure the webhook to send to a configured endpoint.

webhook for prod - endpoint: https://api.foo.com/customer/fusionauth/webhook
webhook for test - endpoint: https://api-test-foo.com/customer/fusionauth/webhook
webhook for dev - endpoint: https://api-dev-foo.com/customer/fusionauth/webhook

In the example above the applications are configured in FusionAuth as dedicated environment tenants and applications, but when we configure the webhook to only the application, it does not fire on the event. When we use the "All application" setting the webhook fires but the POST sends data to all of our environment endpoints */customer/fusionauth/webhook regardless of what application triggered the event.

+1 We are also doing that.

[haziqtanveer]

Hi robotdan,

I have configured the webhook for all the applications, but the webhook didn't fire at all.
Can you please guide? it's 1.21.0 version newly deployed

[maabreuc]

@haziqtanveer You have to go to Tenant -> Edit -> Webhook tab, and enable the webhooks from there.

[LucasPiffer]

For user.registration.create

1. Enabled webhook config inside tenant

2. Configured webhook for one application

3. Registered the user
   ❌ No HTTP Request was fired

4. 🧠 Enabled webhook for all applications

5. Registered the user
   ✅ HTTP request was sent and webhook worked.

[robotdan]

@LucasPiffer this is working as designed. It is a bit confusing, see this comment for an explanation. #169 (comment)

This is something we plan to improve to avoid confusion.

[mooreds]

@LucasPiffer Does this section of the webhook documentation help? https://fusionauth.io/docs/v1/tech/events-webhooks/events/#application-scoped-events

In general, you want to enable webhooks at the tenant level and then filter on the application id.

[LucasPiffer]

Hey, @robotdan and @mooreds thanks! I configured at tenant and left all applications enabled. In my application I made some checks to avoid events from another application.

[saul-data]

Hi @mooreds and @robotdan, I just experienced the same - I selected which applications the webhooks should fire off for and it fails to fire off - I am not even sure what the purpose of these selections are - see screenshot. I guess a user is always global and not application specific - though that could cause a lot of traffic (and wastage) for a multi tenant environment where webhooks are going to different locations.

[mooreds]

I guess a user is always global and not application specific

Yes, a user always belongs to a tenant, not to the application.

Sorry for the confusion! We know it's an area that could use some refinement. Unfortunately it is not currently on the near term roadmap to fix the UI/API to deprecate this confusing functionality.

But if there are documentation changes you can recommend that would help people avoid the frustration you encountered, I'd love to hear them.

[saul-data]

Yeah I think just put in the documentation to say that user is a global so any event is global and won’t fire off a webhook if only the application is selected. I added some checks in my code that look for the tenant id. The application id is more complex as a list of application ids come back so a developer would need to loop through the application ids to test that the event if for that application. Best Saul

…

On Thu, 10 Jun 2021 at 13:00, Dan Moore ***@***.***> wrote: I guess a user is always global and not application specific Yes, a user always belongs to a tenant, not to the application. Sorry for the confusion! We know it's an area that could use some refinement. Unfortunately it is not currently on the near term roadmap to fix the UI/API to deprecate this confusing functionality. But if there are documentation changes you can recommend that would help people avoid the frustration you encountered, I'd love to hear them. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#169 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/APGDMKPDQYNO3JBSSHZVDZDTSCSM5ANCNFSM4HPDG4CQ> .

[robotdan]

Closing this out. We have finally removed the application configuration and made these tenant scoped which should remove most of the confusion I think.

See

• Move Webhoks to a Tenant config instead of Application #1812
• https://fusionauth.io/docs/v1/tech/release-notes#version-1-37-0

Please re-open if there are specific items not addressed in the latest release.