Identity module
This module implements the User and Role system of an application;
- Built on the Microsoft's ASP.NET Core Identity library.
- Manage roles and users in the system. A user is allowed to have multiple roles.
- Set permissions in role and user levels.
- Enable/disable two factor authentication and user lockout per user.
- Manage basic user profile and password.
- Manage claim types in the system, set claims to roles and users.
- Setting page to manage password complexity, user sign-in, account and lockout.
See the module description page for an overview of the module features.
How to install
Identity is pre-installed in the startup templates. So, no need to manually install it.
Packages
This module follows the module development best practices guide and consists of several NuGet and NPM packages. See the guide if you want to understand the packages and relations between them.
NuGet packages
- Volo.Abp.Identity.Domain.Shared
- Volo.Abp.Identity.Domain
- Volo.Abp.Identity.Pro.Application.Contracts
- Volo.Abp.Identity.Pro.Application
- Volo.Abp.Identity.EntityFrameworkCore
- Volo.Abp.Identity.MongoDB
- Volo.Abp.Identity.AspNetCore
- Volo.Abp.PermissionManagement.Domain.Identity
- Volo.Abp.Identity.Pro.HttpApi
- Volo.Abp.Identity.Pro.HttpApi.Client
- Volo.Abp.Identity.Pro.Web
NPM packages
- @volo/abp.ng.identity
- @volo/abp.ng.identity.config
User interface
Menu items
Identity module adds the following items to the "Main" menu, under the "Administration" menu item:
- Roles: Role management page.
- Users: User management page.
- Claim Types: Claim type management page.
IdentityMenuNames
class has the constants for the menu item names.
Pages
Role management
Roles page is used to manage roles in the system. A role is a set of permissions assigned to the users.
You can create a new role or edit a role in this page:
- Default roles are assigned to new users by default.
- Public roles are visible to other users.
Role permissions
You can manage permissions of a role:
- A permission is an action of the application granted to roles and users.
- A user with a role will inherit all the permissions granted for the role.
- Any module can define permissions. Once you define a new permission, it will be available in this page.
- Left side is the list of modules. Once you click to a module name, you can check/uncheck permissions related to that module.
Role claims
You can set custom claim values for a role:
Claim types are retrieved from the claim list defined in the Claim Types Management page (see below).
User management
Users page is used to manage the users in your system.
You can create a new user or edit an existing user in this page:
- A user can have zero or more roles in the system.
- You can set two factor verification and user lockout settings per user.
User permissions
A user has union of the permissions of the assigned roles. Identity module also allows to grant extra permissions to a specific user.
User claims
You can also set custom claim values for a user:
Claim types are retrieved from the claim list defined in the Claim Type Management page (see below).
Claim type management
Identity module allows to define custom claim types.
- Custom claims can be used to store additional information to a user or role.
- Custom claim values then can be accessed in the application code for an authenticated user.
- Claim Types are also used by the Identity Server module if you're using it.
Identity module settings UI
Identity module adds a new tab to the Settings page to customize the behavior on runtime.
Data seed
This module adds some initial data (see the data seed system) to the database when you run the .DbMigrator
application:
- Creates an
admin
role with all the permissions granted. - Creates an
admin
user with theadmin
role and1q2w3E*
as the password.
You normally change this password when you first run the application in your production environment. But if you want to change the password of the seed data, find the ProjectNameDbMigrationService in your solution, locate to the MigrateAsync
method. There will be a line like that:
await _dataSeeder.SeedAsync();
Change it like that:
await _dataSeeder.SeedAsync(
new DataSeedContext()
.WithProperty("AdminPassword", "myPassW00rd42")
);
Just like the password, you can also set the admin email (use the AdminEmail
key in this case).
The data seed contributor class of the Identity module is
IdentityDataSeedContributor
which internally uses theIIdentityDataSeeder
service.
Options
AbpIdentityAspNetCoreOptions
AbpIdentityAspNetCoreOptions
can be configured in the UI layer, in the ConfigureServices
method of your module. Example:
Configure<AbpIdentityAspNetCoreOptions>(options =>
{
//Set options here...
});
AbpIdentityAspNetCoreOptions
properties:
ConfigureAuthentication
(default: true): Identity module callsAddAuthentication
andAddIdentityCookies
extension methods by default to configure the authentication for the Identity library. It setsDefaultScheme
toIdentityConstants.ApplicationScheme
andDefaultSignInScheme
toIdentityConstants.ExternalScheme
. You can set this property tofalse
to suppress it and configure it yourself.
Internals
Domain layer
Aggregates
This module follows the Entity Best Practices & Conventions guide.
User
A user is generally a person logins to and uses the application.
IdentityUser
(aggregate root): Represents a user in the system.IdentityUserRole
(collection): Roles to the user.IdentityUserClaim
(collection): Custom claims of the user.IdentityUserLogin
(collection): External logins of the user.IdentityUserToken
(collection): Tokens of the user (used by the Microsoft Identity services).
Role
A role is typically a group of permissions to assign to the users.
IdentityRole
(aggregate root): Represents a role in the system.IdentityRoleClaim
(collection): Custom claims of the role.
Claim type
A claim type is a definition of a custom claim that can be assigned to other entities (like roles and users) in the system.
IdentityClaimType
(aggregate root): Represents a claim type definition. It contains some properties (e.g. Required, Regex, Description, ValueType) to define the claim type and the validation rules.
Repositories
This module follows the Repository Best Practices & Conventions guide.
Following custom repositories are defined for this module:
IIdentityUserRepository
IIdentityRoleRepository
IIdentityClaimTypeRepository
Domain services
This module follows the Domain Services Best Practices & Conventions guide.
User manager
IdentityUserManager
is used to manage users, their roles, claims, passwords, emails, etc. It is derived from Microsoft Identity's UserManager<T>
class where T
is IdentityUser
.
Role manager
IdentityRoleManager
is used to manage roles and their claims. It is derived from Microsoft Identity's RoleManager<T>
class where T
is IdentityRole
.
Claim type manager
IdenityClaimTypeManager
is used to perform some operations for the IdentityClaimType
aggregate root.
Settings
See the IdentitySettingNames
class members for all settings defined for this module.
Application layer
Application services
IdentityUserAppService
(implementsIIdentityUserAppService
): Implements the use cases of the user management UI.IdentityRoleAppService
(implementIIdentityRoleAppService
): Implements the use cases of the role management UI.IdentityClaimTypeAppService
(implementsIIdentityClaimTypeAppService
): Implements the use cases of the claim type management UI.IdentitySettingsAppService
(implementsIIdentitySettingsAppService
): Used to get and update settings for the Identity module.IdentityUserLookupAppService
(implementsIIdentityUserLookupAppService
): Used to get information for a user byid
oruserName
. It is aimed to be used internally by the ABP framework.ProfileAppService
(implementsIProfileAppService
): Used to change a user's profile and the password.
Database providers
Common
Table / collection prefix & schema
All tables/collections use the Abp
prefix by default. Set static properties on the AbpIdentityDbProperties
class if you need to change the table prefix or set a schema name (if supported by your database provider).
Connection string
This module uses AbpIdentity
for the connection string name. If you don't define a connection string with this name, it fallbacks to the Default
connection string.
See the connection strings documentation for details.
Entity Framework Core
Tables
- AbpRoles
- AbpRoleClaims
- AbpUsers
- AbpUserClaims
- AbpUserLogins
- AbpUserRoles
- AbpUserTokens
- AbpClaimTypes
MongoDB
Collections
- AbpRoles
- AbpUsers
- AbpClaimTypes
Permissions
See the IdentityPermissions
class members for all permissions defined for this module.
Distributed Eevents
This module doesn't define any additional distributed event. See the standard distributed events.