Shared User Accounts: invited+accepted user cannot log in ("Invalid username or password")

Environment

• ABP version: 10.3.0 (commercial — Identity.Pro, Account.Pro, Saas)
• .NET: 10
• UI: none (backend API only; testing via Postman)
• Multi-tenancy: enabled, database-per-tenant (each tenant has its own DB; host is a separate DB)
• User sharing strategy: TenantUserSharingStrategy.Shared
• Distributed lock: configured (Redis) — required by Shared strategy
• Custom tenant key (header): options.TenantKey = "linksetenantid"

Relevant config:

// Domain module
Configure<AbpMultiTenancyOptions>(options =>
{
    options.IsEnabled = true;
    options.UserSharingStrategy = TenantUserSharingStrategy.Shared;
});

// HttpApi.Host module
Configure<AbpAspNetCoreMultiTenancyOptions>(options =>
{
    options.TenantKey = "linksetenantid"; // custom header name instead of __tenant
});

What I did (steps to reproduce)

1. Created the host and a tenant named "Dev" (database-per-tenant; Dev has its own database).
2. Logged in to the host as the default admin.
3. Invited an existing user (userA — email userA@example.com) into tenant Dev using the invitation feature.
4. Received the invitation email and accepted it via the user-sharing accept endpoint:

POST /api/account/user-sharing/invitation/accept Content-Type: application/json { "token": "

The accept returned success. (Before accepting, `GET /api/account/user-sharing/invitation?token=...`
returned `requireRegister: true`, `tenantName: "Dev"`, `inviteeEmail: "userA@example.com"`.)

## What I see in the databases after accept
- In the **host** database `AbpUsers`: I see a record for `userA`, **but it has a non-null `TenantId`** (the Dev tenant's id) — I did **not** see a `TenantId = NULL` (host) record for this user.
- In the **Dev tenant** database `AbpUsers`: I see 1 record for `userA` (with the Dev `TenantId`).

(Question: under Shared accounts, should there be a host record with `TenantId = NULL` for this user? That is the part I'm unsure about — see below.)

## The problem
When `userA` tries to log in, I get **"Invalid username or password!"** (`invalid_grant`).

From the server logs, the token request resolves the tenant to **Host**, then searches for the user
in the **host** context and finds nothing:

```xml
Starting resolving tenant...
Trying to resolve tenant through 'CurrentUser'...
Trying to resolve tenant through 'AbpAccount'...
Tenant resolved by 'AbpAccount' as 'Host'.
No tenant resolved.
...
No user found matching username: "userA@example.com"
→ invalid_grant: "Invalid username or password!"

Notice my custom header resolver (linksetenantid) is never reached — the AbpAccount contributor resolves to Host and the chain stops.

I send the login request like this:

POST /connect/token
linksetenantid: <Dev tenant id>          <-- my custom tenant header
grant_type=password
username=userA@example.com
password=<password>
client_id=...&client_secret=...&scope=...

…but the linksetenantid header appears to be ignored at the token endpoint.

My questions

1. Why can userA not log in after being invited+accepted under Shared accounts?
2. Is the host record supposed to have TenantId = NULL? In my host DB the user only appears with a tenant id, and there is no TenantId = NULL host record. Is the accept flow supposed to create a host (TenantId = NULL) record, and could the missing host record be why login can't find the user in host context?
3. How is a Shared user supposed to log in to a tenant? It looks like the linksetenantid header is intentionally ignored at /connect/token once Shared is enabled (the AbpAccount tenant resolver forces Host). Is the intended flow: log in host-side (no tenant), then use the SwitchTenant grant? If so, host login requires a host (TenantId = NULL) record — which I don't seem to have for this user.
4. Does database-per-tenant change any of this? Since host and tenant are separate databases, does the invite/accept flow correctly create the host record in the host DB and the tenant copy in the tenant DB? Could a cross-database issue cause the host record to be missing?
5. Is the custom tenant header (TenantKey = "linksetenantid") supported with Shared accounts, or does Shared mode change tenant resolution at login such that the header is not used?

Exception message and full stack trace

(login response)
{
  "error": "invalid_grant",
  "error_description": "Invalid username or password!",
  "error_uri": "https://documentation.openiddict.com/errors/ID2024"
}

(No server-side exception — the request completes; the log shows "No user found matching username".)

Summary of what I think is happening

After enabling Shared accounts, login resolves to Host (the linksetenantid header is not used at the token endpoint), and the user appears to have no host (TenantId = NULL) record — only records with a tenant id — so host-side login can't find the user. I'd like to know the correct way to make an invited+accepted Shared user able to log in, and whether the missing TenantId = NULL host record (or the custom tenant header being ignored at login) is the root cause.

I just started using session management with openiddict, now everything looks ok. but when I enabled LogoutFromSameTypeDevices I find that all session has same Device on DB (AbpSessions) so I wonder why and how to control what value is passed to db. second question is it possible to make custom rule about it? for example if client is Web only 1 login allowed, if client is "Mobile" you can 5 or unlimited token etc. ?

abp version 9.2.0

Hello,

We have recently upgraded our ABP modules from version 7.0.3 to 9.1.0, and we are looking to enable and utilize Session Management in our solution.

Our project currently references the following modules:

Volo.Abp.Identity.Pro.*

Volo.Abp.IdentityServer.*

After the upgrade, we confirmed that the AbpSessions table has been created successfully. However, we are seeing logs indicating that a SessionId is not found in the database (it means never saved). It's unclear why this is happening, and we would appreciate any guidance on this.

Could you please advise on what steps we should take to correctly enable and use the session management feature?

Thank you in advance for your support.