Shared Accounts from Tenants - duplicate username #10619

5 Answer(s)

• 

  0

  AI-Bot created 5 months ago

  Support Team ABP Agent

  • With TenantUserSharingStrategy.Shared, username/email must be globally unique (Host + all tenants). So having two different users with the same UserName = admin is not expected in a correctly working Shared User Accounts setup.
  • The symptom you see during login (“only the first tenant’s admin works; the other returns Invalid username or password”) is consistent with this: the login flow (host-side) resolves a user by username/email, finds the first matching “admin”, then password verification is performed for that user. If the password you typed belongs to the other “admin” record, it fails and you get “Invalid username or password”.

  What to do (verified, definitive)

  1. Do not seed/create “admin” separately per tenant when using Shared strategy.

     • In Shared mode, the recommended flow is:
       1. Create tenant
       2. Invite an existing global user (or let them register from invitation)
       3. Assign roles in that tenant
     • If you created tenants in a way that auto-creates a tenant-local admin user (classic isolated behavior), you can end up with conflicting global identities.

  2. Fix your current data

     • In the Host database, ensure there is only one AbpUsers record for a given UserName (and also uniqueness across emails).
     • Then associate that single global user with multiple tenants via the Shared User Accounts invitation/association mechanism (rather than having separate “admin” users).

  3. Re-test using invitations

     • Create a single global user (e.g., admin) once.
     • Invite that user into tenant A and tenant B.
     • On login, ABP should authenticate once and then (if user belongs to multiple tenants) show a tenant selection step.

  Conclusion

  This behavior is not expected under Shared User Accounts; it indicates your tenants were created/seeded in a way that produced duplicate global identities (two different host users with the same username). The correct approach is one user globally + tenant associations, not “one admin per tenant”.

  • https://abp.io/docs/latest/modules/account/shared-user-accounts
  • https://abp.io/community/articles/mf3bkg79

  ---

  This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  Buckoge created 5 months ago

  Ok, I forgot to mention that all of this was done using the SaaS module manually.

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  maliming created 5 months ago

  Support Team Fullstack Developer

  Hi,

  You're right, this is a problem. The invite-accept path didn't run the global username/email uniqueness check in shared mode, so two different invitees could each claim admin in their tenant. Host AbpUsers ended up with duplicate rows and login can only resolve the first one, which is why the second tenant's admin can't sign in.

  Until the fix ships in 10.2.2 / 10.3.1 you can either give each tenant's admin a unique username (e.g. admin-tenant1 / admin-tenant2), or drop this UserSharingManager override into your Domain module to reject the duplicate right now:

  [Dependency(ReplaceServices = true)]
  [ExposeServices(typeof(UserSharingManager))]
  public class MyUserSharingManager : UserSharingManager
  {
      public MyUserSharingManager(
          IOptions<AbpMultiTenancyOptions> multiTenancyOptions,
          IDataFilter dataFilter,
          ITenantStore tenantStore,
          IdentityProUserManager userManager,
          IIdentityUserRepository userRepository,
          IdentityRoleManager roleManager,
          IIdentityRoleRepository roleRepository,
          UserInvitationManager userInvitationManager,
          IAbpDistributedLock distributedLock)
          : base(multiTenancyOptions, dataFilter, tenantStore, userManager, userRepository, roleManager, roleRepository, userInvitationManager, distributedLock)
      {
      }
  
      public override async Task AcceptInviteAsync(Guid invitationId, string username, string password, string passwordHash)
      {
          if (IsEnabled())
          {
              var invitation = await UserInvitationManager.GetAsync(invitationId);
              if (invitation.Status == UserInvitationStatus.Pending)
              {
                  var hostUsersWithUserName = await GetUsersByUserNameFromHostAsync(username, includeLeaved: true);
                  if (hostUsersWithUserName.Any(x => !string.Equals(x.Email, invitation.InviteeEmail, StringComparison.OrdinalIgnoreCase)))
                  {
                      throw new BusinessException(IdentityProErrorCodes.InviteUserUserNameAlreadyExists).WithData("UserName", username);
                  }
  
                  var hostUsersWithEmail = await GetUsersByEmailFromHostAsync(invitation.InviteeEmail, includeLeaved: true);
                  if (hostUsersWithEmail.Any(x => !string.Equals(x.UserName, username, StringComparison.OrdinalIgnoreCase)))
                  {
                      throw new BusinessException(IdentityProErrorCodes.InviteUserEmailAlreadyExists).WithData("Email", invitation.InviteeEmail);
                  }
              }
          }
  
          await base.AcceptInviteAsync(invitationId, username, password, passwordHash);
      }
  }
  

  If you already have duplicate rows in host AbpUsers from testing, delete one or rename its UserName so login can disambiguate.

  Thanks

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  Buckoge created 5 months ago

  Hi,

  Thank you for the explanation.

  I came across this while testing and wasn’t sure of the best place to report it, so i decided to share it here. As mentioned earlier, we are still in the pre-production phase, so we’re happy to wait for the fix in the upcoming release.

  Thanks again, glad i could help 🙂

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  maliming created 5 months ago

  Support Team Fullstack Developer

  Hi,

  Thanks for catching this during testing — really appreciate it, that kind of feedback before production saves us a lot of pain. The fix will land in the next release, so you can grab it from there.

  Thanks

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel