Thank you for the quick response.
Abp Nuget is down. Unable to restore from https://nuget.abp.io/
Thanks again,
What exactly we can implement using those links? can you please explain or give a sample?
Thanks @mailiming,
In this case, for every new client, I would need to make changes in Middleware correct? What are some other option adhering to best practices. For example, Multiple authentication schemes, multiple clients for Identity server
We've set up an External API that's meant for a specific client or consumer. This client will be using Token-based authentication to access the API (either through a Controller or an AppService). However, we want to restrict their access only to this particular API and prevent them from accessing any of our other APIs.
The issue we're facing is that some of our controllers or AppServices don't have the [Authorize] attribute, and we need to protect those by requiring a token. Currently, if we generate a token, we can access these endpoints without proper authorization. We can't solve this using permissions because it requires us to decorate methods with Authorize("permission").
For instance, we generate a token from the endpoint: https://our-IdentityServer.com/connect/token using the default JWT Scheme. The parameters include:
grant_type: password scope: Microservice1, Microservice2, Microservice3, and so on client_id: App1 client_secret: xyz123 username: ExternalUser password: Test1234
Important: The token generate for client should not be able to access any of other restricted non-restricted (without [Autthorize] services) APIs of the system.
Currently there are no limits on number of attempts that could be made to this functionality which creates risk of brute force. Do we have any existing validations or feature to protect such attacks in abp.io?
Great, Thank you so much for the quick help.
Hi @liangshiwei
We have created a CustomTenantAppService
public class CustomTenantAppService : ApplicationService, ITenantAppService { //Some code here to return tenant related data }
DO we need to apply same [Authorize(SaasHostPermissions.Tenants.Default] in this class?
Thanks for the quick response.
Please can you guide where we might be missing Authorisation? Do we need to override this API in our application and how to do it with less impact on overall functionality?
Unauthenticated users were able to retrieve the contents of the tenants and paged tenants. https://myhost/api/saas/tenants
How to Secure this in our application?