Open Closed

external provider login before creating abp user #10418

User avatar
0
rcalv002 created

create a new project, add a tenant, login to tenant and set account overide for external login support.

Fill in the settings and log out. Attempt to login to the tenant with the external provider (without first creating abp user). External provider login succeeds redirects to main application, 400 bad request error: Logs show as below

[22:32:51 INF] Executing endpoint '/Account/Register'
[22:32:51 INF] Route matched with {page = "/Account/Register", action = "", controller = "", area = ""}. Executing page /Account/Register
[22:32:51 INF] Skipping the execution of current filter as its not the most effective filter implementing the policy Microsoft.AspNetCore.Mvc.ViewFeatures.IAntiforgeryPolicy
[22:32:51 INF] Executing handler method Volo.Abp.Account.Public.Web.Pages.Account.RegisterModel.OnPostAsync - ModelState is Invalid
[22:32:51 INF] Start processing HTTP request GET https://graph.microsoft.com/v1.0/me/photo/$value
[22:32:51 INF] Sending HTTP request GET https://graph.microsoft.com/v1.0/me/photo/$value
[22:32:51 INF] Received HTTP response headers after 228.7578ms - 200
[22:32:51 INF] End processing HTTP request after 228.9203ms - 200
[22:32:52 INF] AuthenticationScheme: Identity.Application signed in.
[22:32:52 INF] Executed handler method OnPostAsync, returned result Microsoft.AspNetCore.Mvc.RedirectResult.
[22:32:52 INF] Executing RedirectResult, redirecting to https://mydomain/?page=%2FAccount%2F~%2FAccount%2FLogin.
[22:32:52 INF] Executed page /Account/Register in 816.1899ms
[22:32:52 INF] Executed endpoint '/Account/Register'
[22:32:52 INF] Sending welcome email to tenant user: 3a1f6215-78b1-8c0b-88c4-73b736847965, TenantId: 3a1f6144-16da-f3f5-27cf-6826c562fcbf
[22:32:52 INF] Executing endpoint 'Volo.Abp.AspNetCore.Mvc.UI.Theme.Shared.Controllers.ErrorController.Index (Volo.Abp.AspNetCore.Mvc.UI.Theme.Shared)'
[22:32:52 INF] Route matched with {action = "Index", controller = "Error", area = "", page = ""}. Executing controller action with signature System.Threading.Tasks.Task`1[Microsoft.AspNetCore.Mvc.IActionResult] Index(Int32) on controller Volo.Abp.AspNetCore.Mvc.UI.Theme.Shared.Controllers.ErrorController (Volo.Abp.AspNetCore.Mvc.UI.Theme.Shared).
[22:32:52 WRN] The provided antiforgery token was meant for a different claims-based user than the current user.
[22:32:52 INF] Authorization failed for the request at filter 'Volo.Abp.AspNetCore.Mvc.AntiForgery.AbpAutoValidateAntiforgeryTokenAuthorizationFilter'.
[22:32:52 INF] Executing StatusCodeResult, setting HTTP status code 400
[22:32:52 INF] Executed action Volo.Abp.AspNetCore.Mvc.UI.Theme.Shared.Controllers.ErrorController.Index (Volo.Abp.AspNetCore.Mvc.UI.Theme.Shared) in 2.6912ms
[22:32:52 INF] Executed endpoint 'Volo.Abp.AspNetCore.Mvc.UI.Theme.Shared.Controllers.ErrorController.Index (Volo.Abp.AspNetCore.Mvc.UI.Theme.Shared)'
[22:32:52 ERR] An unhandled exception has occurred while executing the request.
System.Collections.Generic.KeyNotFoundException: The given key 'IsSeeding' was not present in the dictionary.
at System.Collections.Generic.Dictionary`2.get_Item(TKey key)
at Cns.Cloud.Apps.Users.UserCreatedEventHandler.HandleEventAsync(EntityCreatedEto`1 eventData) in /work/src/myproject/Users/UserCreatedEventHandler.cs:line 46
at Volo.Abp.EventBus.EventHandlerInvoker.InvokeAsync(IEventHandler eventHandler, Object eventData, Type eventType)
at Volo.Abp.EventBus.EventBusBase.TriggerHandlerAsync(IEventHandlerFactory asyncHandlerFactory, Type eventType, Object eventData, List`1 exceptions, InboxConfig inboxConfig)
at Volo.Abp.EventBus.EventBusBase.ThrowOriginalExceptions(Type eventType, List`1 exceptions)
at Volo.Abp.EventBus.EventBusBase.TriggerHandlersAsync(Type eventType, Object eventData)
at Volo.Abp.EventBus.Local.LocalEventBus.PublishAsync(LocalEventMessage localEventMessage)
at Volo.Abp.EventBus.Local.LocalEventBus.PublishToEventBusAsync(Type eventType, Object eventData)
at Volo.Abp.EventBus.EventBusBase.PublishAsync(Type eventType, Object eventData, Boolean onUnitOfWorkComplete)
at Volo.Abp.EventBus.Distributed.LocalDistributedEventBus.PublishToEventBusAsync(Type eventType, Object eventData)
at Volo.Abp.EventBus.Distributed.LocalDistributedEventBus.PublishAsync(Type eventType, Object eventData, Boolean onUnitOfWorkComplete, Boolean useOutbox)
at Volo.Abp.EventBus.UnitOfWorkEventPublisher.PublishDistributedEventsAsync(IEnumerable`1 distributedEvents)
at Volo.Abp.Uow.UnitOfWork.CompleteAsync(CancellationToken cancellationToken)
at Volo.Abp.AspNetCore.Uow.AbpUnitOfWorkMiddleware.InvokeAsync(HttpContext context, RequestDelegate next)
at Microsoft.AspNetCore.Builder.UseMiddlewareExtensions.InterfaceMiddlewareBinder.<>c__DisplayClass2_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at Volo.Abp.AspNetCore.ExceptionHandling.AbpExceptionHandlingMiddleware.InvokeAsync(HttpContext context, RequestDelegate next)
at Volo.Abp.AspNetCore.ExceptionHandling.AbpExceptionHandlingMiddleware.InvokeAsync(HttpContext context, RequestDelegate next)
at Microsoft.AspNetCore.Builder.UseMiddlewareExtensions.InterfaceMiddlewareBinder.<>c__DisplayClass2_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at Microsoft.AspNetCore.Timing.AbpTimeZoneMiddleware.InvokeAsync(HttpContext context, RequestDelegate next)
at Microsoft.AspNetCore.Builder.UseMiddlewareExtensions.InterfaceMiddlewareBinder.<>c__DisplayClass2_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at Volo.Abp.AspNetCore.MultiTenancy.MultiTenancyMiddleware.InvokeAsync(HttpContext context, RequestDelegate next)
at Microsoft.AspNetCore.Builder.UseMiddlewareExtensions.InterfaceMiddlewareBinder.<>c__DisplayClass2_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at Microsoft.AspNetCore.Builder.ApplicationBuilderAbpOpenIddictMiddlewareExtension.<>c__DisplayClass0_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
at Volo.Abp.AspNetCore.Security.AbpSecurityHeadersMiddleware.InvokeAsync(HttpContext context, RequestDelegate next)
at Microsoft.AspNetCore.Builder.UseMiddlewareExtensions.InterfaceMiddlewareBinder.<>c__DisplayClass2_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at Volo.Abp.Studio.Client.AspNetCore.AbpStudioMiddleware.InvokeAsync(HttpContext context, RequestDelegate next)
at Volo.Abp.Studio.Client.AspNetCore.AbpStudioMiddleware.InvokeAsync(HttpContext context, RequestDelegate next)
at Microsoft.AspNetCore.Builder.UseMiddlewareExtensions.InterfaceMiddlewareBinder.<>c__DisplayClass2_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at Volo.Abp.AspNetCore.Tracing.AbpCorrelationIdMiddleware.InvokeAsync(HttpContext context, RequestDelegate next)
at Microsoft.AspNetCore.Builder.UseMiddlewareExtensions.InterfaceMiddlewareBinder.<>c__DisplayClass2_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddlewareImpl.g__Awaited|10_0(ExceptionHandlerMiddlewareImpl middleware, HttpContext context, Task task)
[22:32:52 INF] Request finished HTTP/1.1 POST https://mydomain/Account/Register?isExternalLogin=True&returnUrl=https%3A%2F%2Fmydomain%2F%3Fpage%3D%252FAccount%252F%7E%252FAccount%252FLogin - 302 0 null 1190.0806ms
[22:32:52 INF] Request starting HTTP/1.1 GET http://mydomain/Error?httpStatusCode=400 - null null
[22:32:52 INF] Executing endpoint 'Volo.Abp.AspNetCore.Mvc.UI.Theme.Shared.Controllers.ErrorController.Index (Volo.Abp.AspNetCore.Mvc.UI.Theme.Shared)'
[22:32:52 INF] Route matched with {action = "Index", controller = "Error", area = "", page = ""}. Executing controller action with signature System.Threading.Tasks.Task`1[Microsoft.AspNetCore.Mvc.IActionResult] Index(Int32) on controller Volo.Abp.AspNetCore.Mvc.UI.Theme.Shared.Controllers.ErrorController (Volo.Abp.AspNetCore.Mvc.UI.Theme.Shared).
[22:32:52 INF] Executing ViewResult, running view ~/Views/Error/Default.cshtml.
Go to accepted answer
2 Answer(s)
  • User Avatar
    0
    AI-Bot created
    Support Team ABP Agent
    • Your external provider flow is actually succeeding and ABP is posting to /Account/Register?isExternalLogin=True to auto-create/link the user.
    • The HTTP 400 you see is caused by ABP’s antiforgery validation on the error page pipeline, with this key log line:
      The provided antiforgery token was meant for a different claims-based user than the current user.
    • In your log, the real breaking exception is not ABP but your custom code running right after the user is created:
      System.Collections.Generic.KeyNotFoundException: The given key 'IsSeeding' was not present in the dictionary.
      in Cns.Cloud.Apps.Users.UserCreatedEventHandler.HandleEventAsync(...).

    So you have two issues:

    1. Your UserCreatedEventHandler throws, which breaks the request (this is the primary failure).
    2. The antiforgery warning/400 is a side-effect of the pipeline ending up on /Error?httpStatusCode=400 with a changed user context.

    Fix (definitive)

    1. Fix your event handler to not assume IsSeeding exists (use TryGetValue / ContainsKey, or provide a default). Example pattern:
    public Task HandleEventAsync(EntityCreatedEto<IdentityUserEto> eventData)
{
    // Example: if you stored extra properties somewhere, never index directly
    // var isSeeding = dict["IsSeeding"]; // <- unsafe

    var isSeeding = false;
    if (eventData.Properties != null &&
        eventData.Properties.TryGetValue("IsSeeding", out var value) &&
        value is bool b)
    {
        isSeeding = b;
    }

    if (isSeeding)
    {
        return Task.CompletedTask;
    }

    // normal logic...
    return Task.CompletedTask;
}

    (Adapt to your actual dictionary/object; the key point is don’t index with [...] unless you’re 100% sure it’s there.)

    1. After fixing that exception, the external-login-first-time flow should complete without redirecting into an error path, and the antiforgery 400 should disappear.

    Notes (what ABP is doing)

    • ABP’s Account module can register external users on first login (that’s why /Account/Register?isExternalLogin=True appears).
    • If you are using OpenIdConnect/AzureAD, make sure your provider configuration includes correct claim mappings/scopes (especially email) as described in the ABP article below.

    Sources

    • https://abp.io/community/articles/4603b9cf
    • https://abp.io/support/questions/10356

    This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.

  • User Avatar
    0
    rcalv002 created

    Seems correct!

Assignee
User avatar maliming
Question details
Labels
None yet
Boost Your Development
ABP Live Training
Packages
See Trainings
Mastering ABP Framework Book
The Official Guide
Mastering
ABP Framework
Learn More
Mastering ABP Framework Book
Made with ❤️ on ABP v10.2.0-preview. Updated on February 17, 2026, 09:10
1
ABP Assistant
🔐 You need to be logged in to use the chatbot. Please log in first.