Activities of "maliming"

Hi,

Thanks for testing that. Since the local Production mode works fine, the issue is definitely something specific to your deployed environment.

We confirmed the /api/cms-kit-public/menu-items endpoint returns a 302 redirect to the OIDC login page, so something is forcing authentication on all requests. Could you share a few code snippets to help us find the cause?

1. The Program.cs or Startup.cs of your public website project — mainly the auth-related parts.

2. The main module class of the public website (e.g., YourPublicWebModule.cs) — the ConfigureServices and OnApplicationInitialization methods.

3. Could you also do a quick search in your public website project for FallbackPolicy, RequireAuthenticatedUser, DefaultPolicy, and AddAuthorization? Just paste any matches you find.

4. The appsettings.Production.json from the deployed server (just redact any secrets/connection strings).

No need to share the full project — just these parts should be enough for us to spot the problem.

Thanks

: )

Hi,

The Reset Password page is served by the Auth Server (MVC), not the Angular UI. So you need to customize it in your Auth Server project.

You can override the ResetPassword.cshtml page by creating the same file in your Auth Server project under Pages/Account/ResetPassword.cshtml:

@page
@inject IHtmlLocalizer<AccountResource> L
@inject IHtmlLocalizer<IdentityResource> LI
@using Microsoft.AspNetCore.Mvc.Localization
@using Volo.Abp.Account.Localization
@using Volo.Abp.AspNetCore.Mvc.UI.Packages.Zxcvbn
@using Volo.Abp.Identity.Localization
@model Volo.Abp.Account.Public.Web.Pages.Account.ResetPasswordModel
@inject Volo.Abp.AspNetCore.Mvc.UI.Layout.IPageLayout PageLayout
@{
    PageLayout.Content.Title = L["ResetPassword"].Value;
}

@if (!Model.LocalLoginDisabled)
{
    @if (Model.InvalidToken)
    {
        <div class="alert alert-danger">
            @LI["Volo.Abp.Identity:InvalidToken"]
        </div>
        <a asp-page="./ForgotPassword" class="btn btn-link px-0">@L["ForgotPassword"]</a>
    }
    else
    {
        @section scripts
        {
            <abp-script-bundle name="@typeof(Volo.Abp.Account.Public.Web.Pages.Account.ResetPasswordModel).FullName">
                <abp-script type="@typeof(ZxcvbnScriptContributor)"/>
                <abp-script src="/Pages/Account/PasswordComplexityIndicator.js"/>
                <abp-script src="/Pages/Account/ResetPassword.js"/>
            </abp-script-bundle>
        }
        
        <div class="account-module-form">
            <form method="post">
                <p>@L["ResetPassword_Information"]</p>

                <abp-input asp-for="UserId"/>
                <abp-input asp-for="ResetToken"/>
                <abp-input asp-for="Password"/>
                <abp-input asp-for="ConfirmPassword"/>

                <a abp-button="Secondary" asp-page="./Login" asp-route-returnUrl="@Model.NormalizeReturnUrl">@L["Cancel"]</a>
                <abp-button type="submit" button-type="Primary" text="@L["Submit"].Value"/>
            </form>
            <div class="mt-3">
                <a asp-page="./ForgotPassword" class="btn btn-link px-0">@L["ForgotPassword"]</a>
            </div>
        </div>
    }
}

This adds a "Forgot Password" link in two places:

• When the reset token is invalid, so the user can request a new one.
• Below the reset password form, as a general navigation option.

You can adjust the placement based on your preference. No code-behind file is needed since the default ResetPasswordModel already handles everything.

See also: https://abp.io/docs/latest/framework/ui/mvc-razor-pages/customization-guide#overriding-a-razor-page

Thanks

hi

If you switch your local ASPNETCORE_ENVIRONMENT environment to Production, can you reproduce the issue?

Thanks.

hi

You can also try it in a new template project. If you can reproduce the issue, I can take a look at it too.

Thanks.

hi

Can you share your project source code? I will check the code to find the cause.

liming.ma@volosoft.com

Thanks.

Hi,

To help diagnose the issue, could you please provide some more details?

1. When you say "local environment works", did you verify the menus and home page are visible while not logged in (anonymous/incognito browser)? Or was the testing done while still authenticated?

2. How does your production public website resolve the tenant for anonymous visitors? (e.g., subdomain like tenant.yourdomain.com, a separate domain, query string ?__tenant=, or something else?)

3. Could you open the browser developer tools (Network tab) on your production public website while not logged in, and check what response is returned for /api/cms-kit-public/menu-items? Please share the HTTP status code and response body.

4. If possible, could you share the URL of your production public website so we can check directly?

Thanks

Hi,

LDAP does support multi-tenancy in ABP — it is not host-only.

How to set it up per tenant:

1. Enable the feature for the tenant: Go to SaaS → Tenants, click the Features action for the target tenant, and check LDAP Login under the Identity group.

2. Configure LDAP settings in the tenant context: Switch to the tenant (either by logging in as a tenant admin, or using tenant switching in the host UI), then go to Settings → Identity → Ldap tab. Each tenant can configure its own Server Host, Port, Base DC, Domain, Username, and Password independently.

The underlying implementation uses SetForCurrentTenantAsync for all LDAP settings, which means settings are automatically scoped to the current tenant. The official documentation screenshots also confirm this — the "Enable LDAP feature" screenshot is the per-tenant Features dialog.

Thanks

hi

To answer your question: it's a bit of both. ABP's silent fallback to client credentials when the user token is missing is a framework-level problem we should fix. But why the token goes null is environment-specific — most likely cookie truncation, Redis ticket eviction, or async context loss in a Polly retry.

The AUTH DUMP will tell us which one. If it never triggers post-deployment, the cache poisoning fix is doing its job. Keep an eye on the logs for a few more days and let us know if the dump shows up.

Thanks.

Hi,

The key difference is that Ocelot processes and filters the downstream swagger.json through the gateway's SwaggerGen pipeline (DocInclusionPredicate, DocumentFilter), while YARP simply proxies the raw response from downstream services without any filtering.

Using a separate SwaggerDoc (e.g., "public") in your microservices and pointing the YARP transform to it via PathSet is a clean solution.

For reference, the ABP microservice template takes a different approach — it uses PathRemovePrefix to proxy the default swagger.json from each downstream service, assuming each microservice is already split by responsibility and all its APIs should be exposed through the gateway. Your approach with separate SwaggerDoc groups works well when a single microservice needs to expose only a subset of its APIs through the gateway.

Thanks.