I really appreciate the customization FusionAuth brings to the table - it’s a standout feature that gives you the flexibility to mold it to your specific needs. The model is well-designed, and the feature set is impressive, covering a lot of bases for authentication and user management. It feels developer-friendly, which makes integration into projects smoother and more enjoyable. Review collected by and hosted on G2.com.
Despite its strengths, there are some frustrating drawbacks. The API breaking between releases is a big issue - it’s disruptive and adds unnecessary rework. I also found the authorization customization lacking; there’s no easy way to implement permission-based or attribute-based authorization, which feels like a missed opportunity for a service like this. On top of that, the API can be unreliable. For example, when deleting a user from a group, I’ve seen inconsistent results—sometimes it removes their roles, sometimes it doesn’t, and it’s unpredictable. These issues make it harder to rely on consistently. Review collected by and hosted on G2.com.
Thank you for the feedback and I apologize for some of the technical troubles that you’ve had. I wanted to take an opportunity to address some of the concerns you brought to our attention.
Typically our API rarely changes (we occasionally may add parameters or additional API endpoints but the existing functionality rarely changes). Not to say it never does but we’d be very interested in determining when and how this occurred for you. With that, if you would not mind sharing the API endpoints that gave you trouble on our Community Forum (https://fusionauth.io/community/forum/) we’d be interested in taking a look. If you believe you have found an undocumented bug you can also file an issue here (https://github.com/FusionAuth/fusionauth-issues/issues/).
Regarding your comment about roles and groups, I agree that aspect can be confusing at times. You can find a description of what happens with roles when removing a user from a group here (https://fusionauth.io/docs/apis/groups#remove-users-from-a-group). The major take away is how the roles were applied to the user originally. If roles were originally applied to a user upon registration to an application, manually via the FusionAuth Admin UI, or by using the User API, adding or removing them from a group will not affect those roles. If roles were added when adding a user to a group, then removing that user from the group will also remove the roles.
I hope that provided more clarity and please don’t hesitate to post in our Community forum (https://fusionauth.io/community/forum/) if you have additional questions.
