User Created Under Host Instead of Tenant in Production #10587

6 Answer(s)

• 

  0

  AI-Bot created 5 months ago

  Support Team ABP Agent

  • In ABP, a user is created for the “current tenant” (ICurrentTenant.Id). If tenant resolution fails, CurrentTenant.Id becomes null and the user is created under Host.
  • Your production screenshot shows the request result has "tenantId": null, which means the Identity endpoint is running in Host context in production (even though you are in a tenant UI).

  Apply the following production fixes (these are the common causes where local works but production doesn’t):

  1. Ensure UseMultiTenancy() order is correct in the HTTP pipeline
     In the Web/Identity HTTP API host (where /api/identity/users is served), the middleware order must include Multi-Tenancy in the right place. Use this order:

  app.UseRouting();
  
  app.UseAuthentication();
  
  app.UseMultiTenancy();   // must be AFTER UseAuthentication
  
  app.UseAuthorization();
  
  app.UseEndpoints(endpoints =>
  {
      endpoints.MapControllers();
  });
  

  If UseMultiTenancy() runs before authentication, tenant-related claims/header/cookie context may not be applied as expected in some deployments.

  2. If you are behind NGINX / reverse proxy: allow ABP’s tenant header to pass through
     ABP can resolve tenant from the __tenant header. Some NGINX setups drop headers with underscores by default. Add:

  underscores_in_headers on;
  

  and reload NGINX. Otherwise, the backend won’t receive __tenant, tenant resolution fails, and Identity endpoints operate as Host.

  3. Verify tenant resolution is consistent for the Identity API host Make sure the Identity service/host uses the same tenant resolution strategy you rely on in production (domain/subdomain, header, cookie). If you rely on header-based resolution, the proxy must forward it; if you rely on subdomain/domain, ensure the forwarded host headers are correct.

  ---

  • https://abp.io/docs/latest/framework/architecture/multi-tenancy#multi-tenancy-middleware
  • http://nginx.org/en/docs/http/ngx_http_core_module.html#underscores_in_headers

  ---

  This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  vkelwan created 5 months ago

  Hello this part i need to check in the identity service app.UseRouting();

  app.UseAuthentication();

  app.UseMultiTenancy(); // must be AFTER UseAuthentication

  app.UseAuthorization();

  app.UseEndpoints(endpoints => { endpoints.MapControllers(); }); ?

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  enisn created 5 months ago

  Support Team .NET Developer

  Hi,

  Thanks for the details and screenshots.

  These screenshots point to two separate things:

  1. In your local screenshot, the created user response contains a non-null tenantId.
  2. In production, the created user response shows "tenantId": null.

  In ABP, a new identity user is created with the current tenant context. So when tenantId is null, the request is being handled in host context in production.

  The later maximum of 5 users dialog is a different check. I verified this from the source:

  • This is controlled by the Identity.MaxUserCount feature.
  • Its default value is 0, which means unlimited.
  • So if you are seeing 5, that value was explicitly set for the current context.

  Please check these from the host side:

  1. On the app/service that serves the user creation API, make sure app.UseMultiTenancy() is enabled and placed after app.UseAuthentication() as in the startup templates.
  2. Verify that your production tenant resolver is working for that API as well. Since the production response shows tenantId: null, the API is currently not resolving the tenant there.
  3. Open the tenant's Features dialog and check Identity -> Maximum user count.
  4. If the tenant is assigned to an edition, also check the edition's feature value, because feature lookup falls back from tenant to edition.
  5. If you want no limit, set Maximum user count to 0.

  Also, if the request is still running as host in production, the 5 value may be coming from the host feature/configuration instead of the tenant. In that case, also check Settings -> Feature Management -> Manage Host Features.

  If it still continues, please share:

  • Which app/service handles the /api/identity/users endpoint.
  • How tenant resolution is configured in production (domain/subdomain, header, cookie, etc.).
  • A screenshot of the Identity -> Maximum user count value for that tenant or its edition.

  Best regards,

  ABP Support Team

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  enisn created 5 months ago

  Support Team .NET Developer

  Hi,

  To determine the exact cause, we need a little more information about your setup, because this kind of problem is often environment-specific in tiered or separated deployments.

  Could you please share the following details?

  1. Your exact ABP version.
  2. Which startup template you are using.
  3. Which UI you are using.
  4. Whether this is a tiered solution / separated auth-server setup / microservice solution.
  5. Which application actually handles the /api/identity/users request in production.
  6. Which reverse proxy or deployment technology you are using in production.
  7. How tenant resolution is configured in production.

  Please also confirm these points:

  • Does this happen for all tenants or only one tenant?
  • Does it happen only in production, while local always works?
  • Is the tenant selected by subdomain, domain, header, cookie, or another custom resolver?

  If possible, please send these screenshots/details from production:

  1. The browser Network tab for the users create request:
     • Request URL
     • Request headers
     • Response preview showing tenantId
  2. The tenant's Features dialog, especially Identity -> Maximum user count
  3. If the tenant uses an edition, the edition's Identity -> Maximum user count value too

  Reason for asking: in tiered/separated deployments, the UI may look like it is inside a tenant context while the backend request is still resolved as host, especially when tenant resolution depends on proxy-forwarded host/header/cookie information.

  Once you share these details, we can tell you exactly where to check next.

  Best regards,

  ABP Support Team

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  vkelwan created 5 months ago

  Hello team from this On the app/service that serves the user creation API, make sure app.UseMultiTenancy() is enabled and placed after app.UseAuthentication() as in the startup templates.

  it's now sorted

  thank you

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel

  1
• 

  0

  enisn created 5 months ago

  Support Team .NET Developer

  Thanks for confirming.

  Glad to hear it is sorted.

  For future reference, this kind of behavior is usually caused by the backend app/service handling /api/identity/users running without the correct tenant context in production. In tiered or separated deployments, app.UseMultiTenancy() should be enabled on that backend service and placed after app.UseAuthentication() as in the ABP startup templates.

  Also, the maximum of 5 users message is a separate feature limit. If you see that again, please check Identity -> Maximum user count on the tenant, its edition, or host features depending on your setup.

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel