Administrator level grouping and permissions under a specific Tenant #1243

6 Answer(s)

• 

  0

  alper created 3 years ago

  Support Team Director

  @lalitChougule sorry for my late response.

  This is a complex use case and there's no built-in way to achieve this type of usage. OrganizationUnits doesn't cover all your requirements. With OrganizationUnits you can group users and assign a role to an organization unit. But when you grant user create permission to AnchorAdmin, he'll be creating users for others as well.

  Options:

  1- You can create a new tenant for Anchors, Suppliers, Buyers. Then all your requirements will be supported. And you'll create the entities you share among them with not multitenant so that you can share the records.

  ---

  2- You can override existing register user and get user list methods. So that you can implement your own logic.

  These methods are virtual and open to override.

  namespace Volo.Abp.Identity
  {
      public class IdentityUserAppService : IdentityAppServiceBase, IIdentityUserAppService
      {    
          public virtual async Task<PagedResultDto<IdentityUserDto>> GetListAsync(GetIdentityUsersInput input)
          {
              [Authorize(IdentityPermissions.Users.Create)]
              public virtual async Task<IdentityUserDto> CreateAsync(IdentityUserCreateDto input)
              {
                  await IdentityOptions.SetAsync();
  
                  var user = new IdentityUser(
                      GuidGenerator.Create(),
                      input.UserName,
                      input.Email,
                      CurrentTenant.Id
                  );
  
                  input.MapExtraPropertiesTo(user);
  
                  (await UserManager.CreateAsync(user, input.Password)).CheckErrors();
                  await UpdateUserByInput(user, input);
                  (await UserManager.UpdateAsync(user)).CheckErrors();
                  await CurrentUnitOfWork.SaveChangesAsync();
  
                  await DistributedEventBus.PublishAsync(new IdentityUserCreatedEto()
                  {
                      Id = user.Id,
                      Properties =
                      {
                          { "SendConfirmationEmail", input.SendConfirmationEmail.ToString().ToUpper() },
                          { "AppName", "MVC" }
                      }
                  });
  
                  var userDto = ObjectMapper.Map<IdentityUser, IdentityUserDto>(user);
  
                  return userDto;
              }
          }
      }
  }
  

  and also

  Get user list method:

  namespace Volo.Abp.Identity
  {
      public class IdentityUserAppService : IdentityAppServiceBase, IIdentityUserAppService
      {    
          public virtual async Task<PagedResultDto<IdentityUserDto>> GetListAsync(GetIdentityUsersInput input)
          {
              var count = await UserRepository.GetCountAsync(input.Filter); //TODO:
              var users = await UserRepository.GetListAsync(input.Sorting, input.MaxResultCount, input.SkipCount,
                  input.Filter);
  
              var userDtos = ObjectMapper.Map<List<IdentityUser>, List<IdentityUserDto>>(users);
  
              var twoFactorEnabled = await IdentityProTwoFactorManager.IsOptionalAsync();
              for (int i = 0; i < users.Count; i++)
              {
                  userDtos[i].IsLockedOut = users[i].LockoutEnabled &&
                                            (users[i].LockoutEnd != null && users[i].LockoutEnd > DateTime.UtcNow);
                  userDtos[i].SupportTwoFactor = twoFactorEnabled;
              }
  
              return new PagedResultDto<IdentityUserDto>(
                  count,
                  userDtos
              );
          }
      }
  }
  

  3- Add the Identity module source code to your project and you are free to customize everything.

  there maybe other options but these are the first one come to my mind.

  Save Cancel
• 

  0

  murat.yuceer created 3 years ago

  We have same scenario, i was created ticket about that. If system grows you will need like that requirements. I thinked maybe features could be scoped if he want. Like feature admin, just can manage own feature and every feature could be scoped about permissions, roles but is an issue to be considered

  Save Cancel
• 

  0

  alper created 3 years ago

  Support Team Director

  What would you do if you have a plain ASP.NET Core application?

  Save Cancel
• 

  0

  lalitChougule created 3 years ago

  Hi @alper,

  Thanks for the response.

  I implemented your second approach, I customized code for the mentioned methods. It was just a POC for now, but in near future I have to develop full functionality. For now it's kinda configured via appsetting.json approach like if RoleA log's in he ill be able to see user's only under RoleA or which ever role the user is associated with. I want to make it more dynamic.

  appsetting.json

  "UserAccessControl": {
      "FetchUsersByClaims": [
        "SupplierAdmin"
      ],
      "UserCreationWithClaims": [
        "SupplierAdmin"
      ],
      "FetchUsersByRoles": {
        "admin": "AnchorAdmin",
        "AnchorAdmin": "SellerAdmin",
        "SupplierAdmin": "Supplier",
        "SellerAdmin": "Seller"
      },
      "CannotEditUserWithRoles": {
        "AnchorAdmin": "AnchorAdmin"
      },
      "CannotDeleteUserWithRoles": {
        "AnchorAdmin": "AnchorAdmin,SupplierAdmin"
      }
    }
  

  Here as u see my config file in UserAccessControl a section called FetchUsersByRoles, here I have mentioned which If my logged in use if of role admin he can only get users of role AnchorAdmin.Likewise other sections.

  This is where my config file have control, I want to give this control to my Admin user. I want to generate a screen and allow Admin himself to have a control over this.And in future we add new roles to our system, we can have control over them as well.

  If you can simply proved any better approach to manage this requirement will be very helpfull.

  Save Cancel
• 

  0

  alper created 3 years ago

  Support Team Director

  you can use Settings to store UserAccessControl

  Save Cancel
• 

  0

  ServiceBot created 3 years ago

  Support Team Automatic process manager

  This question has been automatically marked as stale because it has not had recent activity.

  Save Cancel