How to Use Password-Only Authentication in Fabrixly-IDS

Overview

Password-only authentication is the traditional login method using email (or mobile number) and password. It's simple and familiar to most users.

Configuration

Step 1: Set Up Fabrixly-IDS Client

Configure your OIDC client in the Admin Console or via API:

Admin Console:

1. Go to Clients → select your client → Edit
2. Under Authentication Settings:
   • Set Auth Mode to Password Only
   • Toggle Enable Mobile Login as needed
   • Set OTP Delivery Method (not used for password-only, but still set)
3. Save

API Request:

curl -X POST https://ids.fabrixly.com/api/clients \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <your-admin-jwt-token>" \
  -d '{
    "client_name": "Password Only App",
    "redirect_uris": ["http://localhost:3002/callback"],
    "response_types": ["code"],
    "grant_types": ["authorization_code", "refresh_token"],
    "token_endpoint_auth_method": "client_secret_basic",
    "auth_mode": "password",
    "enable_mobile_login": false,
    "otp_delivery_method": "email",
    "requires_consent": false
  }'

User Experience Flow

1. User visits your app's login page
2. App redirects to Fabrixly-IDS login screen with email/mobile and password fields
3. User enters credentials and clicks "Sign In"
4. Fabrixly-IDS validates password
5. User is redirected back to your app with auth code
6. App exchanges code for tokens
7. User is logged in!

Example: Node.js Express App

Create password-only-app.js:

const express = require('express');
const session = require('express-session');
const { Issuer, generators } = require('openid-client');

const app = express();
const PORT = 3002;

app.use(session({
  secret: 'secure-session-secret',
  resave: false,
  saveUninitialized: true
}));

async function init() {
  const issuer = await Issuer.discover('https://ids.fabrixly.com/oidc');
  return new issuer.Client({
    client_id: 'your-client-id',
    client_secret: 'your-client-secret',
    redirect_uris: ['http://localhost:3002/callback']
  });
}

let client;
init().then(c => client = c);

// Login route
app.get('/login', (req, res) => {
  req.session.state = generators.state();
  req.session.nonce = generators.nonce();
  
  const authUrl = client.authorizationUrl({
    scope: 'openid profile email',
    state: req.session.state,
    nonce: req.session.nonce
  });
  res.redirect(authUrl);
});

// Callback
app.get('/callback', async (req, res) => {
  const params = client.callbackParams(req);
  const tokenSet = await client.callback(
    'http://localhost:3002/callback',
    params,
    { state: req.session.state, nonce: req.session.nonce }
  );
  
  req.session.tokenSet = tokenSet;
  req.session.user = await client.userinfo(tokenSet.access_token);
  res.redirect('/dashboard');
});

// Dashboard
app.get('/dashboard', (req, res) => {
  if (!req.session.user) return res.redirect('/login');
  
  res.send(`
    <h1>Password-Only Login Demo</h1>
    <p>Welcome, ${req.session.user.email}!</p>
    <a href="/logout">Logout</a>
  `);
});

app.listen(PORT, () => console.log(`App on http://localhost:${PORT}`));

Security Considerations

1. Always use HTTPS to protect passwords in transit
2. Fabrixly-IDS stores passwords hashed with bcrypt, no plaintext
3. Use strong password policies (minimum length, complexity)
4. Enable account locking after failed attempts
5. Encourage users to use unique, strong passwords

Troubleshooting

• "Invalid password" error: Check user credentials, ensure password is correct
• Login form doesn't show password field: Verify auth_mode is set to "password" in client config
• User can't log in with mobile number: Ensure enable_mobile_login is true and user has a verified mobile number

Next Steps

• Try the 2FA mode for higher security
• Implement forgot password flow
• Add password complexity requirements