Activities of "cvarela@ld"

Hi,

The approach you shared sounds easier to implement but it also sounds like it could more easily break as new versions of ABP are released and it could be confusing for our admin users as well. For example:

• If a user is invited to more than one tenant, I believe this override would list that user more than once in the users admin page.
• if in the future shadow rows no longer have different ids, this will break.
• We would also need to override the UI to remove actions that were not overriden here or that are tenant-specific to avoid confusions.

Main concern for us here is, we don't want to have to keep updating this logic as it breaks with future ABP updates. It seems to us like going the every user in every tenant must have a host user route so that the host admin can manage host only policies to all users would be less problematic.

Considering that, our idea was to always create a host user for any tenant-only user and assign those users a Tenant Only role. In the UI, after authentication if the user has the Tenant Only role we do not display Host as an option and we do the same on Switch Tenant . We would also need to stop a user that tries to authenticate using APIs to the Host but has a Tenant Only role.

We don't really know how much code we would need to change for this but we figure if we do this once we wont have to worry about shared user accounts updates in the future.

Thanks.

Hi,

Thank you for the analysis and your response. Based on your response it seems like the work around to all our problems is to create host users for every tenant-scoped user so that we can manage those users from the host. The problem we have is that we don't want tenant-scoped users to be able to login to the host, only admin users should be allowed to login to the host. In order to fix our issues but also keep this functionality we would like to override the tenant selection options in both login and switch tenant options so that we can stop it from displaying "host" as an option unless the user is an admin in the host. We would like to do something like this:

After successful authentication if the user is not an admin:

• Check how many non-host tenants the user has been invited into
• If the user is in more than 1 non-host tenant, allow ABP to display the tenant selection UI (while hiding "host" as an option)
• If the user is in only 1 non-host tenant, automatically redirect them into that tenant

Can you provide guidance on how to override this behavior?

Thank you very much.

Hi,

How can I create a solution in that specific version (10.3.0)? I've updated my ABP Studio and a new solution defaults to ABP 10.4.

In any case we're in the process of updating to ABP 10.4 so I figured I tried the same scenario in that version and it doesn't work properly either. In ABP 10.4 even though I toggle force change password the user is able to log in and is not required to change the password. I sent that sample through wetransfer and there's a video in the zip file of the test I did.

Thanks.

Hi,

To answer your questions:

1. ABP version 10.3.0
2. We use separate database per tenant, so yes the tenant has it's own connection string and database.
3. We've tried all 3 scenarios, via invitation, host admin and seeded directly and they all fail. In this particular example what I did was:
   1. Create a new tenant from scratch.
   2. Login as an admin to the new tenant
   3. Invite a user
   4. User accepts the invitation
   5. As an admin in the tenant I enabled the Force change password for that user.
   6. When the user tries to login it doesn't ask for password change and it doesn't let them login either. I need to uncheck the force change password for the user to login.
4. test.password was invited to a specific tenant only (not the host) so it only exists in the tenant db and has a shadow record in the host database but with a different id. There are no records in the host users table for test.password with TenantId = NULL.

I'll try to reproduce this in a separate minimal project in case these details are not enough.

Thanks.

Hi,

I added your snippet in the ConfigureServices method of the Auth module and it did not work, still just sent me back to login.

I tried applying Force change password to a Host user account and that worked fine. It's just when I do it from a tenant that it doesn't work. Here are the logs of the test after pasting the code you shared:

[22:53:12 WRN] The user should change password! (username: "test.password", id:"cc9a955b-932b-adb2-4eee-3a219c847c79") [22:53:12 INF] AuthenticationScheme: Abp.Account.Cookie signed in. [22:53:12 INF] Executed handler method OnPostAsync, returned result Microsoft.AspNetCore.Mvc.RedirectToPageResult. [22:53:12 INF] Executing RedirectToPageResult, redirecting to ./ChangePassword. [22:53:12 INF] Executed page /Account/Login in 93.0332ms [22:53:12 INF] Executed endpoint '/Account/Login' [22:53:12 INF] Request finished HTTP/2 POST https://localhost:44335/Account/Login?ReturnUrl=%2Fconnect%2Fauthorize%3Fclient_id%3DPortal_BlazorServer%26redirect_uri%3Dhttps%253A%252F%252Flocalhost%253A44337%252Fsignin-oidc%26response_type%3Dcode%2520id_token%26scope%3Dopenid%2520profile%2520roles%2520email%2520phone%2520Portal%26response_mode%3Dform_post%26nonce%3D639160591679453180.NWM1MThkOTItODc3Ni00NTc4LWI2YTMtNjU1MzAxZGY2MDgxZmJjMjRmNWMtY2UwMC00OWIxLWJmMGUtNjU5OGNmNTZiNjE0%26state%3DCfDJ8HsL4swFLDZJp_SIAjZzOqKPpwz1Atc64KXujCT_rFX70jH8J7po6j99e5-gKFoTwQMHsRtFu9kQqvgbARRFPDVRF3qhN5Q4ednZ30-XkWwhtYelKxx-6WXBYNOvyH0V-VpKwI5lmRcuj9VVIjOu-9IPrj0eplKcoXF4qNt3OhMZJkb7zhVZFaQxK2sY3GUs0MAZeTiFUNzzVDa12aipCGcuacvOHaKerQp9HQTxpI3WGDjcVG3LkrBybjFyyiCmTyilPUUSeZxCw7Fx3DxymS4Xkq0TMXYlmZHxd1A_hINr%26x-client-SKU%3DID_NET10_0%26x-client-ver%3D8.16.0.0 - 302 0 null 102.0507ms [22:53:12 INF] Request starting HTTP/2 GET https://localhost:44335/Account/ChangePassword?returnUrl=%2Fconnect%2Fauthorize%3Fclient_id%3DPortal_BlazorServer%26redirect_uri%3Dhttps%253A%252F%252Flocalhost%253A44337%252Fsignin-oidc%26response_type%3Dcode%2520id_token%26scope%3Dopenid%2520profile%2520roles%2520email%2520phone%2520Portal%26response_mode%3Dform_post%26nonce%3D639160591679453180.NWM1MThkOTItODc3Ni00NTc4LWI2YTMtNjU1MzAxZGY2MDgxZmJjMjRmNWMtY2UwMC00OWIxLWJmMGUtNjU5OGNmNTZiNjE0%26state%3DCfDJ8HsL4swFLDZJp_SIAjZzOqKPpwz1Atc64KXujCT_rFX70jH8J7po6j99e5-gKFoTwQMHsRtFu9kQqvgbARRFPDVRF3qhN5Q4ednZ30-XkWwhtYelKxx-6WXBYNOvyH0V-VpKwI5lmRcuj9VVIjOu-9IPrj0eplKcoXF4qNt3OhMZJkb7zhVZFaQxK2sY3GUs0MAZeTiFUNzzVDa12aipCGcuacvOHaKerQp9HQTxpI3WGDjcVG3LkrBybjFyyiCmTyilPUUSeZxCw7Fx3DxymS4Xkq0TMXYlmZHxd1A_hINr%26x-client-SKU%3DID_NET10_0%26x-client-ver%3D8.16.0.0&RememberMe=False - null null [22:53:12 DBG] The event OpenIddict.Validation.OpenIddictValidationEvents+ProcessRequestContext was successfully processed by OpenIddict.Validation.AspNetCore.OpenIddictValidationAspNetCoreHandlers+ResolveRequestUri. [22:53:12 DBG] The event OpenIddict.Server.OpenIddictServerEvents+ProcessRequestContext was successfully processed by OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandlers+ResolveRequestUri. [22:53:12 DBG] The event OpenIddict.Server.OpenIddictServerEvents+ProcessRequestContext was successfully processed by OpenIddict.Server.OpenIddictServerHandlers+InferEndpointType. [22:53:12 DBG] The event OpenIddict.Server.OpenIddictServerEvents+ProcessRequestContext was successfully processed by Volo.Abp.Account.Web.Pages.Account.OpenIddictImpersonateInferEndpointType. [22:53:12 DBG] The event OpenIddict.Server.OpenIddictServerEvents+ProcessRequestContext was successfully processed by OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandlers+ValidateTransportSecurityRequirement. [22:53:12 DBG] The event OpenIddict.Server.OpenIddictServerEvents+ProcessRequestContext was successfully processed by OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandlers+ValidateHostHeader. [22:53:12 DBG] The event OpenIddict.Validation.OpenIddictValidationEvents+ProcessAuthenticationContext was successfully processed by OpenIddict.Validation.AspNetCore.OpenIddictValidationAspNetCoreHandlers+ValidateHostHeader. [22:53:12 DBG] The event OpenIddict.Validation.OpenIddictValidationEvents+ProcessAuthenticationContext was successfully processed by OpenIddict.Validation.OpenIddictValidationHandlers+EvaluateValidatedTokens. [22:53:12 DBG] The event OpenIddict.Validation.OpenIddictValidationEvents+ProcessAuthenticationContext was successfully processed by OpenIddict.Validation.AspNetCore.OpenIddictValidationAspNetCoreHandlers+ExtractAccessTokenFromAuthorizationHeader. [22:53:12 DBG] The event OpenIddict.Validation.OpenIddictValidationEvents+ProcessAuthenticationContext was successfully processed by OpenIddict.Validation.AspNetCore.OpenIddictValidationAspNetCoreHandlers+ExtractAccessTokenFromBodyForm. [22:53:12 DBG] The event OpenIddict.Validation.OpenIddictValidationEvents+ProcessAuthenticationContext was successfully processed by OpenIddict.Validation.AspNetCore.OpenIddictValidationAspNetCoreHandlers+ExtractAccessTokenFromQueryString. [22:53:12 DBG] The event OpenIddict.Validation.OpenIddictValidationEvents+ProcessAuthenticationContext was successfully processed by OpenIddict.Validation.AspNetCore.OpenIddictValidationAspNetCoreHandlers+ExtractClientCertificate. [22:53:12 DBG] The event OpenIddict.Validation.OpenIddictValidationEvents+ProcessAuthenticationContext was successfully processed by OpenIddict.Validation.OpenIddictValidationHandlers+ValidateRequiredTokens. [22:53:12 DBG] The event OpenIddict.Validation.OpenIddictValidationEvents+ProcessAuthenticationContext was marked as rejected by OpenIddict.Validation.OpenIddictValidationHandlers+ValidateRequiredTokens. [22:53:12 DBG] AuthenticationScheme: OpenIddict.Validation.AspNetCore was not authenticated. [22:53:12 DBG] Starting resolving tenant... [22:53:12 DBG] Trying to resolve tenant through 'CurrentUser'... [22:53:12 DBG] Trying to resolve tenant through 'AbpAccount'... [22:53:12 DBG] Tenant resolved by 'AbpAccount' as 'Host'. [22:53:12 DBG] No tenant resolved. [22:53:12 INF] Executing endpoint '/Account/ChangePassword' [22:53:12 INF] Route matched with {page = "/Account/ChangePassword", area = "", action = "", controller = ""}. Executing page /Account/ChangePassword [22:53:12 INF] Skipping the execution of current filter as its not the most effective filter implementing the policy Microsoft.AspNetCore.Mvc.ViewFeatures.IAntiforgeryPolicy [22:53:12 INF] Executing handler method Volo.Abp.Account.Public.Web.Pages.Account.ChangePasswordModel.OnGetAsync - ModelState is Valid [22:53:12 INF] AuthenticationScheme: Abp.Account.Cookie signed out. [22:53:12 INF] Executed handler method OnGetAsync, returned result Microsoft.AspNetCore.Mvc.RedirectToPageResult. [22:53:12 INF] Executing RedirectToPageResult, redirecting to ./Login. [22:53:12 INF] Executed page /Account/ChangePassword in 12.0422ms [22:53:12 INF] Executed endpoint '/Account/ChangePassword' [22:53:12 INF] Request finished HTTP/2 GET https://localhost:44335/Account/ChangePassword?returnUrl=%2Fconnect%2Fauthorize%3Fclient_id%3DPortal_BlazorServer%26redirect_uri%3Dhttps%253A%252F%252Flocalhost%253A44337%252Fsignin-oidc%26response_type%3Dcode%2520id_token%26scope%3Dopenid%2520profile%2520roles%2520email%2520phone%2520Portal%26response_mode%3Dform_post%26nonce%3D639160591679453180.NWM1MThkOTItODc3Ni00NTc4LWI2YTMtNjU1MzAxZGY2MDgxZmJjMjRmNWMtY2UwMC00OWIxLWJmMGUtNjU5OGNmNTZiNjE0%26state%3DCfDJ8HsL4swFLDZJp_SIAjZzOqKPpwz1Atc64KXujCT_rFX70jH8J7po6j99e5-gKFoTwQMHsRtFu9kQqvgbARRFPDVRF3qhN5Q4ednZ30-XkWwhtYelKxx-6WXBYNOvyH0V-VpKwI5lmRcuj9VVIjOu-9IPrj0eplKcoXF4qNt3OhMZJkb7zhVZFaQxK2sY3GUs0MAZeTiFUNzzVDa12aipCGcuacvOHaKerQp9HQTxpI3WGDjcVG3LkrBybjFyyiCmTyilPUUSeZxCw7Fx3DxymS4Xkq0TMXYlmZHxd1A_hINr%26x-client-SKU%3DID_NET10_0%26x-client-ver%3D8.16.0.0&RememberMe=False - 302 0 null 13.3468ms [22:53:12 INF] Request starting HTTP/2 GET https://localhost:44335/Account/Login?ReturnUrl=%2Fconnect%2Fauthorize%3Fclient_id%3DPortal_BlazorServer%26redirect_uri%3Dhttps%253A%252F%252Flocalhost%253A44337%252Fsignin-oidc%26response_type%3Dcode%2520id_token%26scope%3Dopenid%2520profile%2520roles%2520email%2520phone%2520Portal%26response_mode%3Dform_post%26nonce%3D639160591679453180.NWM1MThkOTItODc3Ni00NTc4LWI2YTMtNjU1MzAxZGY2MDgxZmJjMjRmNWMtY2UwMC00OWIxLWJmMGUtNjU5OGNmNTZiNjE0%26state%3DCfDJ8HsL4swFLDZJp_SIAjZzOqKPpwz1Atc64KXujCT_rFX70jH8J7po6j99e5-gKFoTwQMHsRtFu9kQqvgbARRFPDVRF3qhN5Q4ednZ30-XkWwhtYelKxx-6WXBYNOvyH0V-VpKwI5lmRcuj9VVIjOu-9IPrj0eplKcoXF4qNt3OhMZJkb7zhVZFaQxK2sY3GUs0MAZeTiFUNzzVDa12aipCGcuacvOHaKerQp9HQTxpI3WGDjcVG3LkrBybjFyyiCmTyilPUUSeZxCw7Fx3DxymS4Xkq0TMXYlmZHxd1A_hINr%26x-client-SKU%3DID_NET10_0%26x-client-ver%3D8.16.0.0 - null null [22:53:12 DBG] The event OpenIddict.Validation.OpenIddictValidationEvents+ProcessRequestContext was successfully processed by OpenIddict.Validation.AspNetCore.OpenIddictValidationAspNetCoreHandlers+ResolveRequestUri. [22:53:12 DBG] The event OpenIddict.Server.OpenIddictServerEvents+ProcessRequestContext was successfully processed by OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandlers+ResolveRequestUri. [22:53:12 DBG] The event OpenIddict.Server.OpenIddictServerEvents+ProcessRequestContext was successfully processed by OpenIddict.Server.OpenIddictServerHandlers+InferEndpointType. [22:53:12 DBG] The event OpenIddict.Server.OpenIddictServerEvents+ProcessRequestContext was successfully processed by Volo.Abp.Account.Web.Pages.Account.OpenIddictImpersonateInferEndpointType. [22:53:12 DBG] The event OpenIddict.Server.OpenIddictServerEvents+ProcessRequestContext was successfully processed by OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandlers+ValidateTransportSecurityRequirement. [22:53:12 DBG] The event OpenIddict.Server.OpenIddictServerEvents+ProcessRequestContext was successfully processed by OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandlers+ValidateHostHeader. [22:53:12 DBG] The event OpenIddict.Validation.OpenIddictValidationEvents+ProcessAuthenticationContext was successfully processed by OpenIddict.Validation.AspNetCore.OpenIddictValidationAspNetCoreHandlers+ValidateHostHeader. [22:53:12 DBG] The event OpenIddict.Validation.OpenIddictValidationEvents+ProcessAuthenticationContext was successfully processed by OpenIddict.Validation.OpenIddictValidationHandlers+EvaluateValidatedTokens. [22:53:12 DBG] The event OpenIddict.Validation.OpenIddictValidationEvents+ProcessAuthenticationContext was successfully processed by OpenIddict.Validation.AspNetCore.OpenIddictValidationAspNetCoreHandlers+ExtractAccessTokenFromAuthorizationHeader. [22:53:12 DBG] The event OpenIddict.Validation.OpenIddictValidationEvents+ProcessAuthenticationContext was successfully processed by OpenIddict.Validation.AspNetCore.OpenIddictValidationAspNetCoreHandlers+ExtractAccessTokenFromBodyForm. [22:53:12 DBG] The event OpenIddict.Validation.OpenIddictValidationEvents+ProcessAuthenticationContext was successfully processed by OpenIddict.Validation.AspNetCore.OpenIddictValidationAspNetCoreHandlers+ExtractAccessTokenFromQueryString. [22:53:12 DBG] The event OpenIddict.Validation.OpenIddictValidationEvents+ProcessAuthenticationContext was successfully processed by OpenIddict.Validation.AspNetCore.OpenIddictValidationAspNetCoreHandlers+ExtractClientCertificate. [22:53:12 DBG] The event OpenIddict.Validation.OpenIddictValidationEvents+ProcessAuthenticationContext was successfully processed by OpenIddict.Validation.OpenIddictValidationHandlers+ValidateRequiredTokens. [22:53:12 DBG] The event OpenIddict.Validation.OpenIddictValidationEvents+ProcessAuthenticationContext was marked as rejected by OpenIddict.Validation.OpenIddictValidationHandlers+ValidateRequiredTokens. [22:53:12 DBG] AuthenticationScheme: OpenIddict.Validation.AspNetCore was not authenticated. [22:53:12 DBG] Starting resolving tenant... [22:53:12 DBG] Trying to resolve tenant through 'CurrentUser'... [22:53:12 DBG] Trying to resolve tenant through 'AbpAccount'... [22:53:12 DBG] Tenant resolved by 'AbpAccount' as 'Host'. [22:53:12 DBG] No tenant resolved. [22:53:12 INF] Executing endpoint '/Account/Login' [22:53:12 INF] Route matched with {page = "/Account/Login", area = "", action = "", controller = ""}. Executing page /Account/Login [22:53:12 INF] Skipping the execution of current filter as its not the most effective filter implementing the policy Microsoft.AspNetCore.Mvc.ViewFeatures.IAntiforgeryPolicy [22:53:12 INF] Executing handler method Volo.Abp.Account.Public.Web.Pages.Account.LoginModel.OnGetAsync - ModelState is Valid [22:53:12 INF] Executed handler method OnGetAsync, returned result Microsoft.AspNetCore.Mvc.RazorPages.PageResult. [22:53:12 DBG] Added bundle 'LeptonX.Global' to the page in 0.35 ms. [22:53:12 DBG] Added bundle 'LeptonX.Global' to the page in 0.71 ms. [22:53:12 DBG] Added bundle 'Volo.Abp.Account.Public.Web.Pages.Account.LoginModel' to the page in 0.05 ms. [22:53:12 INF] Executed page /Account/Login in 57.424ms

Hi,

For Problem 2: Should I add that code to the AuthServer module? I tried adding it and it's not working: Method 'PostConfigure' has 1 parameter(s) but is invoked with 2 argument(s) protected void PostConfigure<TOptions>(Action<TOptions> configureOptions) in class Volo.Abp.Modularity.AbpModule

Thanks

Hi,

Sorry, we seem to have more issues around shared accounts:

1. Settings option inside a tenant is not working anymore: I logged in as an admin to a tenant, clicked the settings option and nothing is displayed.

I can see this in the logs but the user is an admin so not sure what could be going on: [16:22:44 INF] Authorization failed. These requirements were not met: PermissionRequirement: AuditLogging.AuditLogs.SettingManagement [16:22:44 INF] Authorization failed. These requirements were not met: PermissionRequirement: FeatureManagement.ManageHostFeatures [16:22:44 INF] Authorization failed. These requirements were not met: PermissionRequirement: Saas.SettingManagement

2. Force password change doesn't work at a tenant level: If I login to a tenant, edit a user and click "Force change password" it is not forcing the user to change the password. The logs show that the configuration is correct and there's a redirect to change password but the screen where it asks the user to change password is never displayed it only reloads the login:

[16:28:56 INF] Executing handler method Volo.Abp.Account.Public.Web.Pages.Account.LoginModel.OnPostAsync - ModelState is Valid [16:28:57 INF] Try to use LDAP for external authentication [16:28:57 WRN] Ldap login feature is not enabled! [16:28:57 INF] Try to use OAUTH for external authentication [16:28:57 DBG] OAuth login feature is not enabled! [16:28:57 WRN] The user should change password! (username: "test.password", id:"cc9a955b-932b-adb2-4eee-3a219c847c79") [16:28:57 INF] AuthenticationScheme: Abp.Account.Cookie signed in. [16:28:57 INF] Executed handler method OnPostAsync, returned result Microsoft.AspNetCore.Mvc.RedirectToPageResult. [16:28:57 INF] Executing RedirectToPageResult, redirecting to ./ChangePassword. [16:28:57 INF] Executed page /Account/Login in 427.6961ms [16:28:57 INF] Executed endpoint '/Account/Login' [16:28:57 INF] Request finished HTTP/2 POST https://localhost:44335/Account/Login?ReturnUrl=%2Fconnect%2Fauthorize%3Fclient_id%3DPortal_BlazorServer%26redirect_uri%3Dhttps%253A%252F%252Flocalhost%253A44337%252Fsignin-oidc%26response_type%3Dcode%2520id_token%26scope%3Dopenid%2520profile%2520roles%2520email%2520phone%2520Portal%26response_mode%3Dform_post%26nonce%3D639160361142643200.OTgwZmEyNzgtMjk4OC00NDg3LTkxMDAtMmI0OWI2ZjMwY2I5N2U4NGE2ZTAtMGNmMC00NTM0LWE0ZDItZTM3ODg3ZjYxNDZl%26state%3DCfDJ8HsL4swFLDZJp_SIAjZzOqL15zWxL_CN9BfpTOm1xPnMPvdbmvBH9pNNrntcNC48W1UWcvwO_-H76ZF26a6iJiJ-4-UMlEEIp_235AALPZSWoeR1urtIy0FMRRT3PCsbMsOEyflmYy8fK67gaQ9NCjbxyFxdAVguGU0hJMWSrijjNpN6n_3wXFO-Xfzt0zDN7HhZjJORBKPQktPSyQQZEoFNzyfAg6qAaLT1nmzYNJ10bK0f5KeWdPo9ea1vcOIRGvtNkc_08Au7vxmlTjtw-CUElYr4PXasusqjBotXz-Qb%26x-client-SKU%3DID_NET10_0%26x-client-ver%3D8.16.0.0 - 302 0 null 442.6244ms [16:28:57 INF] Request starting HTTP/2 GET https://localhost:44335/Account/ChangePassword?returnUrl=%2Fconnect%2Fauthorize%3Fclient_id%3DPortal_BlazorServer%26redirect_uri%3Dhttps%253A%252F%252Flocalhost%253A44337%252Fsignin-oidc%26response_type%3Dcode%2520id_token%26scope%3Dopenid%2520profile%2520roles%2520email%2520phone%2520Portal%26response_mode%3Dform_post%26nonce%3D639160361142643200.OTgwZmEyNzgtMjk4OC00NDg3LTkxMDAtMmI0OWI2ZjMwY2I5N2U4NGE2ZTAtMGNmMC00NTM0LWE0ZDItZTM3ODg3ZjYxNDZl%26state%3DCfDJ8HsL4swFLDZJp_SIAjZzOqL15zWxL_CN9BfpTOm1xPnMPvdbmvBH9pNNrntcNC48W1UWcvwO_-H76ZF26a6iJiJ-4-UMlEEIp_235AALPZSWoeR1urtIy0FMRRT3PCsbMsOEyflmYy8fK67gaQ9NCjbxyFxdAVguGU0hJMWSrijjNpN6n_3wXFO-Xfzt0zDN7HhZjJORBKPQktPSyQQZEoFNzyfAg6qAaLT1nmzYNJ10bK0f5KeWdPo9ea1vcOIRGvtNkc_08Au7vxmlTjtw-CUElYr4PXasusqjBotXz-Qb%26x-client-SKU%3DID_NET10_0%26x-client-ver%3D8.16.0.0&RememberMe=False - null null [16:28:57 DBG] The event OpenIddict.Validation.OpenIddictValidationEvents+ProcessRequestContext was successfully processed by OpenIddict.Validation.AspNetCore.OpenIddictValidationAspNetCoreHandlers+ResolveRequestUri. [16:28:57 DBG] The event OpenIddict.Server.OpenIddictServerEvents+ProcessRequestContext was successfully processed by OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandlers+ResolveRequestUri. [16:28:57 DBG] The event OpenIddict.Server.OpenIddictServerEvents+ProcessRequestContext was successfully processed by OpenIddict.Server.OpenIddictServerHandlers+InferEndpointType. [16:28:57 DBG] The event OpenIddict.Server.OpenIddictServerEvents+ProcessRequestContext was successfully processed by Volo.Abp.Account.Web.Pages.Account.OpenIddictImpersonateInferEndpointType. [16:28:57 DBG] The event OpenIddict.Server.OpenIddictServerEvents+ProcessRequestContext was successfully processed by OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandlers+ValidateTransportSecurityRequirement. [16:28:57 DBG] The event OpenIddict.Server.OpenIddictServerEvents+ProcessRequestContext was successfully processed by OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandlers+ValidateHostHeader. [16:28:57 DBG] The event OpenIddict.Validation.OpenIddictValidationEvents+ProcessAuthenticationContext was successfully processed by OpenIddict.Validation.AspNetCore.OpenIddictValidationAspNetCoreHandlers+ValidateHostHeader. [16:28:57 DBG] The event OpenIddict.Validation.OpenIddictValidationEvents+ProcessAuthenticationContext was successfully processed by OpenIddict.Validation.OpenIddictValidationHandlers+EvaluateValidatedTokens. [16:28:57 DBG] The event OpenIddict.Validation.OpenIddictValidationEvents+ProcessAuthenticationContext was successfully processed by OpenIddict.Validation.AspNetCore.OpenIddictValidationAspNetCoreHandlers+ExtractAccessTokenFromAuthorizationHeader. [16:28:57 DBG] The event OpenIddict.Validation.OpenIddictValidationEvents+ProcessAuthenticationContext was successfully processed by OpenIddict.Validation.AspNetCore.OpenIddictValidationAspNetCoreHandlers+ExtractAccessTokenFromBodyForm. [16:28:57 DBG] The event OpenIddict.Validation.OpenIddictValidationEvents+ProcessAuthenticationContext was successfully processed by OpenIddict.Validation.AspNetCore.OpenIddictValidationAspNetCoreHandlers+ExtractAccessTokenFromQueryString. [16:28:57 DBG] The event OpenIddict.Validation.OpenIddictValidationEvents+ProcessAuthenticationContext was successfully processed by OpenIddict.Validation.AspNetCore.OpenIddictValidationAspNetCoreHandlers+ExtractClientCertificate. [16:28:57 DBG] The event OpenIddict.Validation.OpenIddictValidationEvents+ProcessAuthenticationContext was successfully processed by OpenIddict.Validation.OpenIddictValidationHandlers+ValidateRequiredTokens. [16:28:57 DBG] The event OpenIddict.Validation.OpenIddictValidationEvents+ProcessAuthenticationContext was marked as rejected by OpenIddict.Validation.OpenIddictValidationHandlers+ValidateRequiredTokens. [16:28:57 DBG] AuthenticationScheme: OpenIddict.Validation.AspNetCore was not authenticated. [16:28:57 DBG] Starting resolving tenant... [16:28:57 DBG] Trying to resolve tenant through 'CurrentUser'... [16:28:57 DBG] Trying to resolve tenant through 'AbpAccount'... [16:28:57 DBG] Tenant resolved by 'AbpAccount' as 'Host'. [16:28:57 DBG] No tenant resolved. [16:28:57 INF] Executing endpoint '/Account/ChangePassword' [16:28:57 INF] Route matched with {page = "/Account/ChangePassword", area = "", action = "", controller = ""}. Executing page /Account/ChangePassword [16:28:57 INF] Skipping the execution of current filter as its not the most effective filter implementing the policy Microsoft.AspNetCore.Mvc.ViewFeatures.IAntiforgeryPolicy [16:28:57 INF] Executing handler method Volo.Abp.Account.Public.Web.Pages.Account.ChangePasswordModel.OnGetAsync - ModelState is Valid [16:28:57 DBG] Starting resolving tenant... [16:28:57 DBG] Trying to resolve tenant through 'CurrentUser'... [16:28:57 DBG] Trying to resolve tenant through 'AbpAccount'... [16:28:57 DBG] Tenant resolved by 'AbpAccount' as 'Host'. [16:28:57 DBG] No tenant resolved. [16:28:57 INF] AuthenticationScheme: Abp.Account.Cookie signed out. [16:28:57 INF] Executed handler method OnGetAsync, returned result Microsoft.AspNetCore.Mvc.RedirectToPageResult. [16:28:57 INF] Executing RedirectToPageResult, redirecting to ./Login. [16:28:57 INF] Executed page /Account/ChangePassword in 27.4135ms

Thank you for help.

Issue 1: Yes, I reused the same id from the tenant table. I will change that in the host table and re-test it. Issue 2: Just to clarify, a host admin user could delete a user inside a tenant? In our system a tenant is a company and an employee could leave the company, so if the employee leaves the company can the host admin delete that user?

Thanks for the help!

Issue 1 - Can you elaborate on what shared-accounts tenant membership/association records are? I can see that the host's AbpUsers table has one row per user and tenant and has a valid id in the tenant id column. I assumed that there's some process that when the user leaves a tenant it queries the host's AbpUsers table with the user's email and tenant id and updates Leaved = 1 in that table. Also worth mentioning that the switch option works, it's the Leave option that doesn't.

Issue 2: I am using the default admin account which has the admin role assigned and that role has the user management delete permission, attaching an image of the admin's permissions screen:

This worked. Thank you @maliming.