Activities of "maliming"

Hi,

Can you share your project structure screenshot?

You can try the steps below:

Step 1: Download the Inter font files from https://github.com/rsms/inter/releases and place them in your project:

wwwroot/fonts/InterVariable.woff2
wwwroot/fonts/InterVariable-Italic.woff2

Step 2: Create a local font CSS file at wwwroot/fonts/local-fonts.css in the Host/Server project:

@font-face {
    font-family: "Inter";
    font-style: normal;
    font-weight: 100 900;
    font-display: swap;
    src: url("/fonts/InterVariable.woff2") format("woff2");
}

@font-face {
    font-family: "Inter";
    font-style: italic;
    font-weight: 100 900;
    font-display: swap;
    src: url("/fonts/InterVariable-Italic.woff2") format("woff2");
}

Step 3: Add URL rewriting middleware in your Blazor module to redirect font-bundle.css requests to your local file. This must run before UseStaticFiles:

public override void OnApplicationInitialization(ApplicationInitializationContext context)
{
    var app = context.GetApplicationBuilder();

    app.Use(async (httpContext, next) =>
    {
        var path = httpContext.Request.Path.Value;
        if (path != null && path.EndsWith("/font-bundle.css", StringComparison.OrdinalIgnoreCase))
        {
            httpContext.Request.Path = "/fonts/local-fonts.css";
        }
        await next();
    });

    // ... rest of your middleware configuration
}

Thanks

Can you try to override OpenIddictImpersonateTenantModel . This class is registered via DI with [ExposeServices], so it can be properly replaced:

[ExposeServices(typeof(ImpersonateTenantModel))]
[Dependency(ReplaceServices = true)]
public class MyImpersonateTenantModel : OpenIddictImpersonateTenantModel
{
    public MyImpersonateTenantModel(
        IPermissionChecker permissionChecker,
        ICurrentPrincipalAccessor currentPrincipalAccessor,
        IOptions<AbpAccountOpenIddictOptions> options)
        : base(permissionChecker, currentPrincipalAccessor, options)
    {
    }

    public override async Task<IActionResult> OnPostAsync()
    {
        // Add your custom validation logic here.
        // For example:
        // if (!CurrentUser.IsInRole("admin") && TenantUserName == "admin")
        // {
        //     throw new BusinessException("...");
        // }

        return await base.OnPostAsync();
    }
}

Place this class in your AuthServer project (or whichever project references Volo.Abp.Account.Pro.Public.Web.OpenIddict). You can remove the previous ImpersonationExtensionGrant override, as it is not needed for Blazor.

At the moment, Postgres seems like a good choice.

Hi,

We have upgraded Scriban to 6.6.0 to fix the NU1902 security warning. See https://github.com/abpframework/abp/pull/25122. This fix will be available in the next 10.2 patch release.

Here are the relevant package versions across ABP releases:

| Version | System.IdentityModel.Tokens.Jwt | Scriban | |---|---|---| | 10.0.x | 8.14.0 | 6.3.0 | | 10.1.x | 8.14.0 | 6.3.0 | | 10.2.x (next patch) | 8.14.0 | 6.6.0 |

In the meantime, you can add the following to your project file to override the transitive dependency version:

<ItemGroup>
  <PackageReference Include="Scriban" Version="6.6.0" />
</ItemGroup>

Regarding the System.IdentityModel.Tokens.Jwt 6.26.1 vulnerability, as DominaTang mentioned, it comes from Microsoft.Graph 4.54.0, not from ABP packages. ABP already uses System.IdentityModel.Tokens.Jwt 8.14.0. You may want to check for a newer version of Microsoft.Graph that addresses this.

Thanks

Hi,

Thank you for your understanding. If you have any further questions or need assistance in the future, feel free to open a new support ticket.

Thanks

Hi,

Thanks for the detailed proposal. We've discussed this internally, and we don't have plans to implement a pre-authentication tenant selection flow for the Shared strategy at this time.

The Shared strategy is fundamentally designed around the "authenticate first, select tenant after" model. In this mode, since user identity is shared across tenants, all security-related settings are managed at the Host level. This means tenants cannot independently configure:

• Password policies (required length, complexity, periodic change, reuse prevention, etc.)
• Lockout policies (lockout duration, max failed attempts, etc.)
• Sign-in settings (require confirmed email/phone, etc.)
• External identity providers (Azure AD, Okta, etc.)

This is by design — when a user's identity is shared across multiple tenants, it wouldn't make sense to allow individual tenants to enforce conflicting security policies on the same user account.

Introducing tenant resolution before authentication (as you proposed) would fundamentally change this model and add significant complexity and potential security concerns (such as email enumeration).

For scenarios that require per-tenant external identity provider configuration or per-tenant security policies, please use the Isolated strategy, which resolves the tenant before authentication and fully supports tenant-level settings.

We understand this means you can't use unified user accounts and per-tenant IdP configuration at the same time. We'll keep this feedback in mind for future improvements.

Thanks

: )

hi

We will support it in 10.3 version.

Add optional CAPTCHA support for the Forgot Password page (new UseCaptchaOnForgotPassword setting), following the same pattern as Login and Registration

Thanks.

hi

We have reset your developer machine.

You can try again.

Thanks

hi

The Shared strategy works as "authenticate first, select tenant after" — at the point the login page is rendered, there's no tenant context yet, so the system doesn't know which tenant's IdP credentials to use. That's why external IdP configuration (along with other security settings like 2FA, lockout, password policies) is handled at the Host level in this mode.

For scenarios where each customer needs their own Azure AD app registration or similar per-tenant IdP setup, the Isolated strategy would be a better fit — it resolves the tenant before authentication, so tenant-specific IdP settings can be loaded properly.

Thanks.