Activities of "maliming"

Hi,

You're welcome. Your details helped us find several issues in Suite.

Thanks

Hi,

Technically it works. A host row with the same username, email and password hash as the tenant rows is treated as the same shared account. The user shows up on the host Users page, can select Host at login, the host 2FA settings apply to them, and password changes stay in sync.

But we don't recommend inserting the rows in the database directly. Use invitations instead, then the application creates the host row for you with the right values.

If you still decide to do it, make sure you back up your data first. Copy the username, email (including the normalized columns) and password hash from the tenant row, set TenantId to NULL, and give the new row its own Id, SecurityStamp and ConcurrencyStamp.

The new host rows have no phone number. Users can add and verify it on the My account page after selecting Host at login.

Thanks

Hi,

I see. The entities stay in the same namespace, and only the files in the Domain and Application.Contracts projects go into a subfolder per entity. We'll take this into account when we evaluate the feature request.

Thanks

Hi,

Yes, both points are correct.

• If you create the user on the host first (no roles needed) and then invite them from the tenants, the account has a host row, so 2FA and the host 2FA settings work for it.
• If the user was invited from a tenant first, creating the same email on the host fails because the email is already taken. Use "Invite user" on the host Users page instead, the user only needs to accept it.

About syncing: only the username, email and password are synchronized. Keeping the name and surname per tenant is by design, so we don't plan to sync all fields. We'll look into the phone number and the 2FA handling for accounts without a host row. I can't give you a date yet, we'll update this ticket when there is news.

Thanks

Hi,

Nothing is missing in your configuration, and you don't need any customization. Here is how Shared user accounts work in 10.6.

A shared account has one row for each tenant it has joined, plus a host row (TenantId = NULL) if the user is also a host user. It is still one account: the same username, email and password work everywhere, and the user selects the tenant at login.

Only the username, email and password are synchronized between these rows. Name, surname, phone number and the other profile fields are kept per tenant by design, so a user can have a different profile in each tenant. When a user joins a tenant, the new row starts with an empty name and surname, that's why you see NULL there.

The host row is the global record of the account. A user who was only invited to tenants has no host row. To keep a user at the global level, create the user on the host first and then invite them to the tenants. For a user who is already in tenants, open the Users page while you are signed in to the host and use "Invite user" with the same email. The user only needs to accept the invitation, there is no new registration.

About 2FA:

2FA is handled on the host side and uses the host row. The 2FA check runs once during login, before the user selects a tenant, and the code is sent to the email or the verified phone number of the host row. A phone number changed on the My account page inside a tenant only changes that tenant's profile, it isn't used for 2FA. To change the phone number used for 2FA, the user selects Host at login, then updates and verifies it on the My account page. We'll look into keeping the phone number in sync between these rows.

When the user has a host row:

• The user can enable 2FA on the My account page after selecting Host at login.
• The host admin can enable 2FA for the user on the host Users page.
• The host 2FA settings, for example forcing 2FA, apply to this user.

Tenant admins can't enable or disable 2FA for a user, and the host 2FA settings don't apply to users who have no host row.

About your other questions:

• Both the host admin and tenant admins can create new users directly. A user created in a tenant belongs only to that tenant.
• To add an existing account to another tenant, use "Invite user" in that tenant. Creating the same user again fails, because the username and email are unique across the host and all tenants.
• When a new user accepts an invitation from Tenant A, the account is created in Tenant A only, with the roles you selected in the invite dialog. No host row is created.
• If you create user B on the host first and then invite the same email from Tenant A, user B only needs to accept the invitation. After that, user B can sign in and choose Host or Tenant A.

You can find more details here: https://abp.io/docs/10.6/modules/account/shared-user-accounts

Thanks

Hi,

Suite only looks for the existing files in the folder of the entity's namespace. A moved file isn't found there, so Suite creates a new one.

If you want subfolders, you can give the entity a nested namespace in Suite, like Kontakte.Adressen. Suite then creates its files in Kontakte/Adressen folders (the test projects use a Kontakte.Adressen folder) and finds them again on the next generation, so the code in the Extended files stays. The C# namespace becomes Bpo.Kontakte.Adressen too. We'll evaluate your folder structure request as a new feature.

To generate several entities at once, you can use abp suite generate. It generates one entity from its JSON file in the .suite/entities folder. Start Suite first with abp suite, otherwise the command starts and stops Suite for every entity. Then run this in the solution folder (PowerShell), with your solution file name:

Get-ChildItem .suite/entities/*.json | ForEach-Object { abp suite generate -e $_.FullName -s (Resolve-Path Bpo.slnx) }

Thanks

Hi,

The generated seeders depend on the seeder of every navigation target, even for optional navigations that are seeded with null. With references in both directions, and the Kontakt → Kontakt self reference, this creates the circular dependency. Removing those seeders from KontakteDataSeedContributor, as you did, is the right workaround for now. We'll fix it in an upcoming version: a seeder will only depend on the seeders of its required navigations, and never on itself.

About the warnings: the nullable warnings in the generated repositories, entities and tests are real, and we'll look into fixing them in the templates. Most of the StyleCop rules in your list (the this. prefix, the _ field prefix, usings inside the namespace, member order, blank lines) are different from ABP's own coding style, so the generated code will keep following ABP's style. Suppressing them in .editorconfig like you did is the right way. The //<suite-custom-code-autogenerated> marker also has to stay as it is.

About the overwritten Extended files: I found one case. When an entity is generated with customizable code turned off, Suite deletes all *.Extended.cs files in the Shared folder of the Application.Contracts project (LookupDto.Extended.cs, LookupRequestDto.Extended.cs, DownloadTokenResultDto.Extended.cs) and generates those DTOs again as normal classes. Any code you added to these files is lost. If that's not your case, please send me the steps when you regenerate.

Thanks

Hi,

I found one case. When an entity has a navigation property or a date property, Suite rewrites the Angular <entity>.component.ts and <entity>-detail.component.ts files (and the child component files) on every generation, even with customizable code enabled. I reproduced this on my side. Your script is the right way to restore them for now.

If it's other files for you, such as the .Extended.cs files on the backend, please send me the file name and the steps.

For the tests: since v10.5, the IDs in the generated test data stay the same between generations, but the other values are still random. The GetListAsync and GetCountAsync tests also expect only the generated test records in the table, so your own seed data breaks the counts.

We'll fix both issues in an upcoming version.

Thanks

Hi,

/connect/revocat makes that token invalid right away. The next API call with it returns 401, and its refresh token stops working too. But it only ends the session that this token belongs to.

The auth server login cookie has its own session. So after your app logs the user out, the next login goes through the auth server, and it signs the user back in without asking for the password.

To log the user out of the browser, revoke all of their sessions from your app server with IdentitySessionManager:

using System;
using System.Threading.Tasks;
using Volo.Abp.DependencyInjection;
using Volo.Abp.Identity;
using Volo.Abp.MultiTenancy;

namespace MyCompanyName.MyProjectName;

public class UserLogoutService : ITransientDependency
{
    private readonly IdentitySessionManager _identitySessionManager;
    private readonly ICurrentTenant _currentTenant;

    public UserLogoutService(IdentitySessionManager identitySessionManager, ICurrentTenant currentTenant)
    {
        _identitySessionManager = identitySessionManager;
        _currentTenant = currentTenant;
    }

    public async Task LogoutAsync(Guid userId, Guid? tenantId)
    {
        using (_currentTenant.Change(tenantId))
        {
            await _identitySessionManager.RevokeAllAsync(userId);
        }
    }
}

Pass null as tenantId for host users. This logs the user out on all devices. Their next request gets a 401, and they have to sign in again.

Some notes:

• This is the Session Management feature of the Identity Pro module (ABP 8.2+). It needs dynamic claims (IsDynamicClaimsEnabled = true and app.UseDynamicClaims()), which the startup templates enable by default.
• If you run more than one host or instance, they all need to use the same distributed cache, like Redis. Otherwise the other instances still see the session in their local cache.
• If you only want to end some of the sessions, use GetListAsync(userId: userId) and RevokeAsync(session) of the same manager.
• Admins can also do this from the UI: Identity > Users > Actions > Sessions, then Log out on a session.

https://abp.io/docs/latest/modules/identity/session-management

Thanks

Hi,

This is a framework bug, so we've refunded your question credit.

Thanks