ImpersonateTenant not work with subdomain tenant resolver #6813

12 उत्तर (ओं)

• 

  0

  liangshiwei बनाया था 2 months ago

  सहायता दल Fullstack Developer

  Hi,

  How do you configure the subdomain tenant resolver?

  Could you share your steps?

  बचाना रद्द करना
• 

  0

  hitaspdotnet बनाया था 2 months ago

  Hi,

  How do you configure the subdomain tenant resolver?

  Could you share your steps?

  in web, web.public & authserver I added:

  Configure<AbpTenantResolveOptions>(options =>
  {
      options.AddDomainTenantResolver(configuration["TenantDomain"]);
  });
  

  also this config in their appSettings:

  "TenantDomain": "https://{0}.app.domain.com"
  ...
  "TenantDomain": "https://{0}.pub.domain.com"
  ...
  "TenantDomain": "https://{0}.auth.domain.com"
  

  in authserver module:

  PreConfigure<AbpOpenIddictWildcardDomainOptions>(options =>
  {
      options.EnableWildcardDomainSupport = true;
      options.WildcardDomainsFormat.Add(configuration["WildCardDomains:AuthServer"]);
      options.WildcardDomainsFormat.Add(configuration["WildCardDomains:Web"]);
      options.WildcardDomainsFormat.Add(configuration["WildCardDomains:PublicWeb"]);
  });
  

  and authserver's appSettings:

  "WildCardDomains": {
      "AuthServer": "https://{0}.auth.domain.com",
      "Web": "https://{0}.app.domain.com",
      "PublicWeb": "https://{0}.pub.domain.com"
  }
  

  then in web & web.public :

  if (Convert.ToBoolean(configuration["AuthServer:IsOnK8s"]))
  {
      context.Services.Configure<OpenIdConnectOptions>(
          "oidc", options =>
          {
              options.MetadataAddress = configuration["AuthServer:MetaAddress"]!.EnsureEndsWith('/') +
                                        ".well-known/openid-configuration";
  
              var previousOnRedirectToIdentityProvider = options.Events.OnRedirectToIdentityProvider;
              options.Events.OnRedirectToIdentityProvider = async ctx =>
              {
                  ctx.ProtocolMessage.IssuerAddress = configuration["AuthServer:Authority"]!.EnsureEndsWith('/') + "connect/authorize";
  
                  var currentTenant = ctx.HttpContext.RequestServices.GetRequiredService<ICurrentTenant>();
                  var tenantDomain = configuration["TenantDomain"];
  
                  if (currentTenant.IsAvailable && !string.IsNullOrEmpty(tenantDomain))
                  {
                      ctx.ProtocolMessage.IssuerAddress =
                          ctx.ProtocolMessage.IssuerAddress.Replace("{0}", $"{currentTenant.Name}");
                  }
                  else
                  {
                      ctx.ProtocolMessage.IssuerAddress =
                          ctx.ProtocolMessage.IssuerAddress.Replace("{0}.", string.Empty);
                  }
  
                  if (previousOnRedirectToIdentityProvider != null)
                  {
                      await previousOnRedirectToIdentityProvider(ctx);
                  }
              };
  
              var previousOnRedirectToIdentityProviderForSignOut =
                  options.Events.OnRedirectToIdentityProviderForSignOut;
              options.Events.OnRedirectToIdentityProviderForSignOut = async ctx =>
              {
                  // Intercept the redirection for signout so the browser navigates to the right URL in your host
                  ctx.ProtocolMessage.IssuerAddress = configuration["AuthServer:Authority"]!.EnsureEndsWith('/') +
                                                      "connect/logout";
  
                  var currentTenant = ctx.HttpContext.RequestServices.GetRequiredService<ICurrentTenant>();
                  var tenantDomain = configuration["TenantDomain"];
                  if (currentTenant.IsAvailable &&
                      !string.IsNullOrEmpty(tenantDomain))
                  {
                      ctx.ProtocolMessage.IssuerAddress =
                          ctx.ProtocolMessage.IssuerAddress.Replace("{0}", $"{currentTenant.Name}");
                  }
                  else
                  {
                      ctx.ProtocolMessage.IssuerAddress =
                          ctx.ProtocolMessage.IssuerAddress.Replace("{0}.", string.Empty);
                  }
  
                  if (previousOnRedirectToIdentityProviderForSignOut != null)
                  {
                      await previousOnRedirectToIdentityProviderForSignOut(ctx);
                  }
              };
          }
      );
  }
  

  and the userMenu in web & web.public

  var authServerUrl = _configuration["AuthServer:Authority"] ?? "~";
  var returnUrl = _configuration["App:SelfUrl"] ?? "";
  
  var currentTenant = context.ServiceProvider.GetRequiredService<ICurrentTenant>();
  var tenantDomain = _configuration["TenantDomain"];
  
  if (currentTenant.IsAvailable && !string.IsNullOrEmpty(tenantDomain))
  {
      authServerUrl = authServerUrl.Replace("{0}", $"{currentTenant.Name}");
      returnUrl = tenantDomain.Replace("{0}", $"{currentTenant.Name}");
  }
  else
  {
      authServerUrl = authServerUrl.Replace("{0}.", string.Empty);
  }
  

  I kept gateways and services as before except openIddict data seeder.

  बचाना रद्द करना
• 

  0

  hitaspdotnet बनाया था 2 months ago

  is it possible to impersonate tenant on the host domain? If yes, please guide me!

  बचाना रद्द करना
• 

  0

  liangshiwei बनाया था 2 months ago

  सहायता दल Fullstack Developer

  There should be work. because the tenant is first determined from the current user and not the domain

  

  And it works for me

  Configure<AbpTenantResolveOptions>(options =>
  {
      options.AddDomainTenantResolver("{0}.localhost");
  });
  

  

  बचाना रद्द करना
• 

  0

  hitaspdotnet बनाया था 2 months ago

  Do I need to config AuthServer:Authority in authServer too? After clicking on Login I see redirect to auth.domain.com which is host's issuer and then redirected to host home page. the url after click on login:

  https://auth.tonner.io/connect/authorize?client_id=Web&redirect_uri=https%3A%2F%2Fapp.tonner.io%2Fsignin-oidc&response_type=code%20id_token&scope=<scopes>&response_mode=form_post&nonce=<nonce>&access_token=<token>&tenantid=bec78466-c1c3-d8dc-beb3-3a112a214a25&tenantusername=admin&returnurl=https%3A%2F%2Fapp.tonner.io%2FSaas%2FHost%2FTenants&state=<state>&x-client-SKU=ID_NET8_0&x-client-ver=7.0.3.0
  

  बचाना रद्द करना
• 

  0

  liangshiwei बनाया था 2 months ago

  सहायता दल Fullstack Developer

  Hi,

  Will this can help you?

  https://github.com/abpframework/abp-samples/blob/master/DomainTenantResolver/MVC-TIERED/src/Acme.BookStore.Web/BookStoreWebModule.cs#L162-L176

  बचाना रद्द करना
• 

  0

  hitaspdotnet बनाया था 2 months ago

  NO, I shared my code as you asked, and already added this.

  बचाना रद्द करना
• 

  0

  liangshiwei बनाया था 2 months ago

  सहायता दल Fullstack Developer

  Hi,

  Can you try to remove the if (Convert.ToBoolean(configuration["AuthServer:IsOnK8s"])) code?

  

  Then you can test it locally to see if it works

  बचाना रद्द करना
• 

  0

  hitaspdotnet बनाया था 2 months ago

  Hi, seems we have a PR related to this issue, Enable Login with this tenant for templates contains microservice-template label. please guide me using that PR if possible.

  बचाना रद्द करना
• 

  0

  maliming बनाया था 2 months ago

  सहायता दल Fullstack Developer

  hi

  The PR is basically the same as your code.

  Did you remove the if (Convert.ToBoolean(configuration["AuthServer:IsOnK8s"])) code?

  बचाना रद्द करना
• 

  0

  hitaspdotnet बनाया था 2 months ago

  hi

  The PR is basically the same as your code.

  Did you remove the if (Convert.ToBoolean(configuration["AuthServer:IsOnK8s"])) code?

  now I see an error, my application is running on k8s, so the value is always true. I'm not sure why it made effect. however, how I can solve this error?

  बचाना रद्द करना
• 

  0

  maliming बनाया था 2 months ago

  सहायता दल Fullstack Developer

  hi

  Please remember to configure the ImpersonationTenantPermission and ImpersonationUserPermission permissions

  See https://docs.abp.io/en/commercial/latest/modules/account/impersonation

  बचाना रद्द करना