How to Use Flexible Authentication with Fabrixly-IDS

Overview

Flexible authentication gives users a choice! They can either enter their password for quick login OR leave it blank to get an OTP! This is the most user‑friendly auth mode!

Step 1: Configure Flexible Mode for Your Client

First, configure your Fabrixly-IDS client for flexible auth:

Admin Console Setup

1. Open Fabrixly-IDS Admin Console → Clients
2. Select or create a client → click Edit
3. Under Authentication Settings:
   • Auth Mode: select Flexible
   • Enable Mobile Login: toggle on/off
   • OTP Delivery Method: choose email/SMS/both
4. Save!

API Setup

Authenticating API Requests

Management API endpoints (like /api/clients, /api/users, etc.) require administrative authentication. To call them:

1. Include the Token in the Authorization Header: Add -H "Authorization: Bearer <your-admin-jwt-token>" to your API calls.

Obtain an Admin JWT Token:

curl -X POST https://ids.fabrixly.com/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "admin@example.com",
    "password": "your-admin-password"
  }'

Note: This returns a JSON response containing a token.

curl -X POST https://ids.fabrixly.com/api/clients \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <your-admin-jwt-token>" \
  -d '{
    "client_name": "Flexible Auth App",
    "redirect_uris": ["http://localhost:3005/callback"],
    "response_types": ["code"],
    "grant_types": ["authorization_code", "refresh_token"],
    "token_endpoint_auth_method": "client_secret_basic",
    "auth_mode": "flexible",
    "otp_delivery_method": "email"
  }'

User Login Flow

1. User visits your app → clicks "Login"
2. Redirected to Fabrixly-IDS login form
3. User enters email/mobile number → then chooses:
   • Option A: Enter password → click "Sign In" (password login)
   • Option B: Leave password field blank → click "Send OTP" → wait for OTP → enter it → click "Verify & Log In" (passwordless)
4. User logs in successfully!

Example Flexible Auth Express App

Create flexible-auth-app.js:

const express = require('express');
const session = require('express-session');
const { Issuer, generators } = require('openid-client');

const app = express();
const PORT = 3005;

app.use(session({
  secret: 'flexibility-is-awesome',
  resave: false,
  saveUninitialized: true
}));

async function init() {
  const issuer = await Issuer.discover('https://ids.fabrixly.com/oidc');
  return new issuer.Client({
    client_id: 'your-flexible-client-id',
    client_secret: 'your-flexible-client-secret',
    redirect_uris: ['http://localhost:3005/callback']
  });
}

let client;
init().then(c => client = c);

app.get('/', (req, res) => {
  if (req.session.user) {
    res.redirect('/dashboard');
  } else {
    res.send(`
      <h1>Flexible Authentication Example</h1>
      <p>Users choose between password or OTP!</p>
      <a href="/login">Login</a>
    `);
  }
});

app.get('/login', (req, res) => {
  req.session.state = generators.state();
  req.session.nonce = generators.nonce();
  
  const authUrl = client.authorizationUrl({
    scope: 'openid profile email',
    state: req.session.state,
    nonce: req.session.nonce
  });
  res.redirect(authUrl);
});

app.get('/callback', async (req, res) => {
  const params = client.callbackParams(req);
  const tokenSet = await client.callback(
    'http://localhost:3005/callback',
    params,
    { state: req.session.state, nonce: req.session.nonce }
  );
  req.session.tokenSet = tokenSet;
  req.session.user = await client.userinfo(tokenSet.access_token);
  res.redirect('/dashboard');
});

app.get('/dashboard', (req, res) => {
  if (!req.session.user) return res.redirect('/');
  
  res.send(`
    <h1>Welcome to Flexible Auth!</h1>
    <p>Hi ${req.session.user.email}! You logged in via either password or OTP!</p>
    <a href="/">Home</a>
  `);
});

app.listen(PORT, () => console.log(`Flexible auth app running on http://localhost:${PORT}`));

Why Use Flexible Authentication?

1. Best User Experience: Users pick what's most convenient for them!
2. Fallback: If a user forgets their password, they can just use OTP instead!
3. Familiar: Users who like passwords can keep using them; users who like passwordless can use OTP!

Use Cases

• SaaS apps: Give users choice
• Internal tools: Some employees prefer passwords, others prefer OTP
• Consumer apps: Cater to all user preferences!

Security Best Practices

• Still use HTTPS!
• Keep OTP expiry short!
• Rate limit both password attempts and OTP requests!

Troubleshooting

• User can't get OTP: Make sure they left password field blank!
• Form doesn't show both options: Verify client's auth_mode is flexible!

Next Steps

• Try magic links for even more simplicity!
• Explore social logins!