Activities of "maliming"

Hi,

Got your log and HAR, thanks. The good news is this isn't a 2FA bug — the login never actually reaches the 2FA step. The log shows a plain password mismatch for user tony:

[INF] Executing handler method Volo.Abp.Account.Public.Web.Pages.Account.LoginModel.OnPostAsync
...
[DBG] Invalid password for user.
[INF] Executed handler method OnPostAsync, returned result Microsoft.AspNetCore.Mvc.RazorPages.PageResult.
[INF] Request finished HTTP/2 POST .../Account/Login - 200 null text/html

The HAR confirms it from the browser side:

• Only one request to /Account/* in the whole capture — POST /Account/Login returning 200 (no redirect, no Location header).
• No request to /Account/SendSecurityCode at all.
• No .AspNetCore.Identity.TwoFactorUserId cookie is ever set in any response.
• The response HTML contains the standard error alert rendered by the Login page:

<div role="alert" class="alert alert-danger alert-dismissible fade show">
    Invalid username or password!
</div>

So what you're seeing as "redirect back to login" is actually the Login page re-rendering itself with the Invalid username or password alert after SignInManager.PasswordSignInAsync returned SignInResult.Failed. The RequiresTwoFactor branch is never hit, which is why you never see the 2FA screen.

My guess on why this correlates with 2FA-enabled accounts: shared-mode user lookup prefers the host user when multiple matches exist. If your 2FA-enabled users were created/migrated in a way that left a different password hash on the host row vs the tenant row, the shared-mode login will now check against the host row — and the password you remember (set on the tenant row) won't match.

Could you try the following and let me know:

1. Sign in as an admin and reset tony's password from the host Identity Users page (make sure you're viewing Host users, not a tenant). Then try logging in with the new password.
2. If that works and you land on the 2FA screen, we've confirmed it's a stale host password from the shared-mode migration.
3. If it still fails after a host-side password reset, send me the new debug log + HAR of that attempt and we'll dig further.

Thanks

Refunded

Hi,

Elsa Studio is a UI project that can be used in Blazor Server and WASM projects. It can be viewed as a standalone project, and currently it is still challenging to fully integrate it into our own project.

Elsa has its own user/role/tenant system, and it is different from ABP:

• Elsa has its own Tenant entity, ITenantStore, ITenantsProvider, ITenantResolver, and /tenants CRUD endpoints.
• Elsa entities use string? TenantId, but ABP uses Guid?.
• Elsa reads the tenant from the http://schemas.microsoft.com/identity/claims/tenantid claim (CustomClaimTypes.TenantId), which is not the same claim name that ABP writes by default.

So all Elsa permissions in AbpElsaPermissionDefinitionProvider are registered as MultiTenancySides.Host for now, and the elsa-pro.md doc also says the module is "not yet fully integrated".

Tenant users logging into Elsa Studio to manage their own workflows is not supported yet. To make it work properly we need a mapping layer between ABP tenants and Elsa tenants, write the Elsa tenant claim to the token, open the permissions to the Tenant side, and optionally bridge ABP's tenant connection string to Elsa's Tenant.Configuration for per-tenant workflow databases.

For now, the suggested way to use the module is:

• Keep the workflow definitions on the Host side and let only host admins log in to Elsa Studio.
• Pass TenantId into the workflow as an input/variable, and let the workflow branch on it when needed.
• In your custom activities, use ICurrentTenant.Change(tenantId) to switch to the target tenant before calling any ABP service (repositories, managers, email, etc.).
• Trigger workflows from ABP distributed events. ABP events already carry the TenantId, so the workflow naturally runs in the context of the right tenant. This is the same pattern used in the ElsaDemoApp sample.

This way a single set of workflow definitions can serve all tenants, and you don't need to work around the multi-tenancy limitation on the Elsa side.

We have already seen the 3.6.0 changes on the Elsa side: TenantsOptions.IsEnabled, "" as the default tenant id, null as tenant-agnostic, the TenantDeleted event, tenant id added to the stored trigger index, etc. These are good improvements, but the multi-tenancy model on the Elsa side is still moving. If we build the integration right now, we will likely have to redo parts of it after the next change on their side.

We will keep the Host-only setup for now, and do a proper multi-tenant integration once Elsa's multi-tenancy is stable. We will update the module and the docs at that time.

Thanks

hi

We fixed it. Can you try again?

Thanks.

hi

Yes, You have to enable the Web Socket feature.

Thanks.

hi

There will be code sending a POST request. Please check it in the browser’s network panel.

Thanks.

hi

Can you share the JSON response of signalr-hubs/chat/negotiate?negotiateVersion=1 endpoint?

Thanks.

hi

Can you share an online website URL?

liming.ma@volosoft.com

Thanks

Hi,

Thanks for the screenshots — checked them, that DCOTPolicies.Attestations.ApiAccess policy is unrelated to the 2FA redirect.

To move forward, could you share two things:

1. Full debug logs of one failing 2FA login(reproduce the problem).
2. A Chrome HAR file capturing all requests/responses from clicking Login until the browser lands back on the login page

Please follow this guide to enable all debug levels and HAR file: https://abp.io/support/questions/8622/How-to-enable-Debug-logs-for-troubleshoot-problems

Since the support form won't let you attach txt/zip, please email both files to liming.ma@volosoft.com and just reply here saying you've sent them.

Thanks

hi

Can you try again?

Thanks.