Non-Existent or Intermittent Internet Access When Using FusionAuth | FusionAuth Forum

Your browser does not seem to support JavaScript. As a result, your viewing experience will be diminished, and you have been placed in read-only mode .

Please download a browser that supports JavaScript, or enable it if it's disabled (i.e. NoScript).

Non-Existent or Intermittent Internet Access When Using FusionAuth

Scheduled

Pinned

Locked

Moved

Solved

Q&A

disconnected

2.1k

Loading More Posts

Oldest to Newest

Newest to Oldest

Most Votes

Reply

Reply as topic

Log in to reply

This topic has been deleted. Only users with topic management privileges can see it.

dan

last edited by

Can I use FusionAuth in a distributed fashion when the internet is non-existent or intermittent? Like if I have a cruise ship, can I copy user data on to it to let them log into apps and possibly change profile or credentials and somehow get that back to a server on the mainland?

FusionAuth - Identity Without Constraints

https://fusionauth.io

1 Reply<br>Last reply

Reply<br>Quote

dan

@dan

last edited by dan

Yes.

A few options. Let's assume you have a FusionAuth instance hosted in your cloud (the cloud instance) and that you'll be running an instance on the cruise ship (the cruise ship instance). The cloud instance contains all user data. The cruise ship instance is going to be set up fresh for each cruise, with a copy of data from the cloud instance. It'll contain just the users on the cruise ship, and applications on the cruise ship will be set up to authenticate against it.

Overview Table

Option<br>Use When<br>Notes<br>Works With FusionAuth Cloud

Use The Cloud Instance<br>You have connectivity. Included for completeness.

Yes

Cruise Ship FusionAuth With QR Codes<br>You only want to let the user modify their profile, are okay with the risk of the QR code being stolen and the user being impersonated.<br>Need to use the API/SDKs to fully implement.<br>Yes

Cruise Ship FusionAuth With Existing Passwords<br>You want the cruise ship instance to be the source of truth for users on the ship.

No

Cruise Ship FusionAuth With Existing Passwords And Changes Allowed to Cloud FusionAuth<br>If accounts of cruise ship users need to be modifiable by people on the cruise ship and on land.<br>Requires careful profile and credential merge logic.<br>No

Use The Cloud Instance

Use the cloud FusionAuth instance for all requests. This is the simplest solution, though it may be costly or lead to degraded functionality.

This is mentioned for completeness, but doesn't really address the core issue of missing or intermittent internet connectivity.

Cruise Ship FusionAuth With QR Codes

Here you are migrating the source of truth for these users to the cruise ship instance, excluding passwords, and then syncing the profile data back.

The main reason to choose this option is because it works with a FusionAuth Cloud hosted cloud instance, where you do not have access to the password hashes.

Steps:

Copy user profile data to the cruise ship instance using the User API.

Create a QR code that is associated with each user and add it to the ticket (or provide it separately). The user can then log in by scanning their phone.

The QR code should include the user's login Id. Implement using the passwordless API, starting the passwordless login with the users id, and completing the login by catching the code and using the complete login API call.

Mark the accounts as 'on-cruise' in the user.data field. By doing this, you can clearly differentiate between the users on the cruise and anyone else in your CIAM system. This makes it easier to merge their profile data after the cruise.

Set up a webhook to disable any updates to these user accounts in the cloud FusionAuth instance while on the cruise. You can do this by setting up a transactional webhook on user.update that fails when the user being updated has the 'on-cruise' attribute set.

When on the ship, users can log in with these credentials and access applications, as well as update their profiles.

After the cruise is done, compare the profile update timestamps for all users in the cruise instance with the same account on the cloud instance.

If the update timestamps do not match, update the cloud instance with the new profile data. Do not move the password hashes.

Remove the 'on-cruise' attribute from users in the cloud instance.

Security Warning: This is a security risk! Understand the security model of an account takeover in the cruise ship instance. If anyone else scans the QR code, they can get access to the user's account.

The benefit is simple merging of data. You also don't need access to the database of the cloud instance, because all the data you are merging is available via the API.

After successfully pushing the data to the cloud server, wipe the cruise ship FusionAuth instance.

Cruise Ship FusionAuth With Existing Passwords

Here you are migrating the source of truth for these users to the cruise ship instance,...