# Login Validation Lambda

An overview of the login validation lambda.

> For the index of this section of the site, see [llms.txt](https://4002.18-224-161-104.sslip.io/docs/llms.txt)

During a login request FusionAuth performs various validations such as verifying credentials or verifying a one time code during a multi-factor login. Using this lambda function, you may extend this functionality to include your own validation as part of a login request.

The login validation lambda has access to the user record, the user's registration for the application they're trying to authenticate to if applicable and meta-data about the request. While Lambda HTTP Connect may be used in this function in order to utilize external resources to perform validation, please be aware that adding latency to the login request will likely be observable to your end user.

When you create a new lambda using the FusionAuth UI we will provide you an empty function for you to implement.

## Lambda Structure

If you are using the API to create the lambda you will need to ensure your function has the following signature:

```javascript
function validate(result, user, registration, context) {
  // Lambda code goes here
}
```

This lambda must contain a function named `validate` that accepts the following parameters:

*   `result` - an object used for returning validation errors. You can modify this object.
*   `user` - the FusionAuth User object. This object is read-only.
*   `registration` - the FusionAuth UserRegistration object. This object is read-only.
*   `context` - an object containing context for the current request. This object is read-only.

The `result` object contains an [Errors](https://4002.18-224-161-104.sslip.io/docs/apis/errors.md) object. For more information about the `user` and `registration` objects, see the [User API](https://4002.18-224-161-104.sslip.io/docs/apis/users.md) and [Registration API](https://4002.18-224-161-104.sslip.io/docs/apis/registrations.md).

`context` is an immutable argument of type `Context`, with the following structure:

```javascript
class Context {

    /**
     * The method used to authenticate the user.
     * @type {String} - Possible values are listed below.
     */
    authenticationType;

    /**
     * The identity provider, present only when the login request is from a 3rd party IdP.
     * @type {IdentityProvider}
     */
    identityProvider;

    /**
      * Provides access to services available to the lambda, including secrets.
      * Use `context.services.secrets.get('<key>')` to retrieve a secret value.
      * @type {Services}
      * @since 1.64.0
      */
    services;
}

class IdentityProvider {

    /**
     * The identifier of the IdP.
     * @type {String}
     */
    id;

    /**
     * The name of the IdP.
     * @type {String}
     */
    name;

    /**
     * The type of the IdP.
     * @type {String}
     */
    type;
}
```

`authenticationtype` is the method used to authenticate the user. The possible values are:

*   `APPLE` - The user was authenticated using Apple.
*   `APPLICATION_TOKEN` - The user was authenticated using an Application Authentication Token.
*   `EpicGames` - The user was authenticated using Epic Games.
*   `FACEBOOK` - The user was authenticated using Facebook.
*   `FEDERATED_JWT` - The user was authenticated using a JWT from an external source.
*   `GENERIC_CONNECTOR` - The user was authenticated using a generic connector.
*   `GOOGLE` - The user was authenticated using Google.
*   `HYPR` - The user was authenticated using HYPR.
*   `JWT_SSO` - A valid JWT associated with one application was exchanged for another JWT associated with a different application.
*   `LDAP_CONNECTOR` - The user was authenticated using an LDAP connector.
*   `LINKEDIN` - The user was authenticated using LinkedIn.
*   `Nintendo` - The user was authenticated using Nintendo.
*   `ONE_TIME_PASSWORD` - The user was authenticated using a one-time password.
*   `OPENID_CONNECT` - The user was authenticated using OIDC.
*   `PASSWORD` - The user was authenticated using a loginId and password combination.
*   `PASSWORDLESS` - The user was authenticated using a passwordless login link.
*   `PING` - The user was authenticated using a `PUT` request on the Login API. This is used to record a login event without prompting for credentials, such as when the FusionAuth SSO session is used.
*   `REFRESH_TOKEN` - The user requested a new JWT using a refresh token.
*   `REGISTRATION` - The user was created using the Registration API.
*   `SAMLv2` - The user was authenticated using SAMLv2.
*   `SAMLv2IdpInitiated` - The user was authenticated using SAMLv2 IdP Initiated login.
*   `SonyPSN` - The user was authenticated using Sony.
*   `Steam` - The user was authenticated using Steam.
*   `TWITTER` - The user was authenticated using Twitter.
*   `Twitch` - The user was authenticated using Twitch.
*   `USER_CREATE` - The user was created using the User API.
*   `WebAuthn` - The user was authenticated using a passkey.
*   `Xbox` - The user was authenticated using Xbox.

To deny a login attempt, simply add one or more field or general errors to the result. The error schema can be found in the [API Errors](https://4002.18-224-161-104.sslip.io/docs/apis/errors.md) documentation.

## Assigning The Lambda

Once a lambda is created, you must assign it to a Tenant. Using the FusionAuth admin UI, find the **Login validation lambda** field found on the Security tab in the Tenant configuration.

For the Tenant API, assign the lambda Id to the **tenant.lambdaConfiguration.loginValidationId** field.

## Example Lambda

Here is an example of a simple Lambda that prevents login attempts by users whose accounts are past due. Note that this is just an example that is assuming you have set the `accountStatus` in the user's data using the User API.

```javascript
function validate(result, user, registration, context) {
  if (user.data.accountStatus === 'pastDue') {
    result.errors.generalErrors = [{
      code: "[LoginRestricted]",
      message: "Account is past due, please contact accounts payable."
    }];
  }
}
```

## Localization

When using any of the Login APIs directly, if the lambda function adds errors to the `result`, the API will respond with a `400` status code and the JSON response will contain the same errors object returned by the lambda function.

When using the FusionAuth hosted login pages, the messaging may be localized. The order of precedence is as follows.

*   If the message key returned in the **code** field is defined in your theme, that localized message will be displayed.
*   If the message key returned in the **code** field is not defined in your theme, the message as provided by the lambda function will be displayed.
*   If the message key returned in the **code** field is not defined in your theme, and the lambda function did not define a value for the `message`, the message key returned in the **code** field will be displayed to the user.

Using the above example, by default the user will be shown the message `Account is past due, please contact accounts payable.`.

To localize this message, or simply modify it to be more user friendly, add the following message to your theme:

```plaintext
[LoginRestricted]=Looks like you forgot to pay your bill. Please call 1-800-555-5555 for assitance.
```

With this change, the user will be shown `Looks like you forgot to pay your bill. Please call 1-800-555-5555 for assitance.`.

Related

[Extend Lambdas An overview of FusionAuth's lambdas, which are pluggable JavaScript code that run at various points in the user lifecycle. fusionauth lambdajavascriptauthentication hook](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas.md)

[Extend JWT Populate Lambda An overview of the JWT populate lambda. fusionauth lambdajavascript](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/jwt-populate.md)

[Extend CIMD Client Registration Lambda An overview of the CIMD client registration lambda. fusionauth lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/cimd-client-registration.md)

[Extend Client Credentials JWT Populate Lambda An overview of the Client Credentials JWT Populate lambda. fusionauth lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/client-credentials-jwt-populate.md)
---

## Other pages in Lambdas

> For the full index of this section, see [Extend](https://4002.18-224-161-104.sslip.io/docs/llms-extend.txt).

- [CIMD Client Registration Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/cimd-client-registration.md): An overview of the CIMD client registration lambda.
- [Client Credentials JWT Populate Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/client-credentials-jwt-populate.md): An overview of the Client Credentials JWT Populate lambda.
- [Lambdas](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas.md): An overview of FusionAuth's lambdas, which are pluggable JavaScript code that run at various points in the user lifecycle.
- [JWT Populate Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/jwt-populate.md): An overview of the JWT populate lambda.
- [Call an API from a Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/lambda-remote-api-calls.md): An overview of how to make API calls from Lambdas.
- [MFA Requirement Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/mfa-requirement.md): An overview of the MFA requirement lambda.
- [Apple Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/apple-reconcile.md): An overview of the Apple Reconcile lambda.
- [Epic Games Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/epic-games-reconcile.md): An overview of the Epic Games Reconcile lambda.
- [External JWT Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/external-jwt-reconcile.md): An overview of the External JWT Reconcile lambda.
- [Facebook Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/facebook-reconcile.md): An overview of the Facebook Reconcile lambda.
- [Google Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/google-reconcile.md): An overview of the Google Reconcile lambda.
- [HYPR Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/hypr-reconcile.md): An overview of the HYPR Reconcile lambda.
- [LDAP Connector Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/ldap-connector-reconcile.md): An overview of the LDAP Connector Reconcile lambda.
- [LinkedIn Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/linkedin-reconcile.md): An overview of the LinkedIn Reconcile lambda.
- [Nintendo Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/nintendo-reconcile.md): An overview of the Nintendo Reconcile lambda.
- [OpenID Connect Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/openid-connect-response-reconcile.md): An overview of the OpenID Connect Response Reconcile lambda.
- [SAML v2 Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/samlv2-response-reconcile.md): An overview of the SAML v2 Response Reconcile lambda.
- [Sony PlayStation Network Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/sony-playstation-network-reconcile.md): An overview of the Sony PlayStation Network Reconcile lambda.
- [Steam Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/steam-reconcile.md): An overview of the Steam Reconcile lambda.
- [Twitch Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/twitch-reconcile.md): An overview of the Twitch Reconcile lambda.
- [Twitter Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/twitter-reconcile.md): An overview of the Twitter Reconcile lambda.
- [Xbox Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/xbox-reconcile.md): An overview of the Xbox Reconcile lambda.
- [SAML v2 Populate Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/samlv2-response-populate.md): An overview of the SAML v2 populate lambda.
- [SCIM Group Request Converter Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/scim-group-request-converter.md): An overview of the SCIM Group Request Converter lambda.
- [SCIM Group Response Converter Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/scim-group-response-converter.md): An overview of the SCIM Group Response Converter lambda.
- [SCIM User Request Converter Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/scim-user-request-converter.md): An overview of the SCIM User Request Converter lambda.
- [SCIM User Response Converter Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/scim-user-response-converter.md): An overview of the SCIM User Response Converter lambda.
- [Self-Service Registration Validation Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/self-service-registration.md): An overview of the Self-Service Registration Validation lambda.
- [Test Lambdas](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/testing.md): A guide on how to create and test lambdas with FusionAuth.
- [Token Exchange Policy Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/token-exchange-policy.md): Reference for the Token Exchange Policy lambda, which decides whether FusionAuth allows a token exchange request.
- [Token Exchange Populate Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/token-exchange-populate.md): Reference for the Token Exchange Populate lambda, which adds or narrows claims in tokens issued through token exchange.
- [UserInfo Populate Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/userinfo-populate.md): An overview of the UserInfo populate lambda.