CurrentTenant across MicroService #6765

6 Vastaus (t)

• 

  0

  liangshiwei luotu 2 months ago

  Tukitiimi Fullstack Developer

  Hi,

  Currently communication between microservices uses client credentials: https://docs.abp.io/en/commercial/latest/startup-templates/microservice/synchronous-interservice-communication

  We have an internal issue with this, may be available in next version

  Tallentaa Peruuttaa
• 

  0

  liangshiwei luotu 2 months ago

  Tukitiimi Fullstack Developer

  if access CurrentTenant property, would it get the same value in Method1

  I think that's fine, ABP will add the current tenant parameters when sending an internal request

  Tallentaa Peruuttaa
• 

  0

  DominaTang luotu 2 months ago

  if access CurrentTenant property, would it get the same value in Method1

  I think that's fine, ABP will add the current tenant parameters when sending an internal request

  Tenant Id currently is in Request header or in access token? I believe UserId are in access token.

  Tallentaa Peruuttaa
• 

  0

  liangshiwei luotu 2 months ago

  Tukitiimi Fullstack Developer

  Hi,

  Tenant Id is in Request header.

  I believe UserId are in access token.

  https://support.abp.io/QA/Questions/6765/CurrentTenant-across-MicroService#answer-3a1109b6-885c-2f65-240c-f25e8d5cd039

  Tallentaa Peruuttaa
• 

  0

  liangshiwei luotu 2 months ago

  Tukitiimi Fullstack Developer

  This is a temporary solution, it should be able to pass the current user's credentials

  You can try override the HttpContextAbpAccessTokenProvider

  [Dependency(ReplaceServices = true)]
  [ExposeServices(typeof(HttpContextAbpAccessTokenProvider), typeof(IAbpAccessTokenProvider))]
  public class MyHttpContextAbpAccessTokenProvider : HttpContextAbpAccessTokenProvider
  {
     ...
     
      public virtual async Task<string?> GetTokenAsync()
      {
          var httpContext = HttpContextAccessor?.HttpContext;
          if (httpContext == null)
          {
              return null;
          }
      
          var token = await httpContext.GetTokenAsync("access_token");
          if (token != null)
          {
              return token;
          }
      
          token = httpContext.Request.Headers["Authorization"];
          if (!token.IsNullOrWhiteSpace() && token.Contains("Bearer "))
          {
              return token.Replace("Bearer ", "");
          }
      
          return null;
      }
  }
  

  Tallentaa Peruuttaa
• 

  0

  liangshiwei luotu 2 months ago

  Tukitiimi Fullstack Developer

  We have an internal issue with this, may be available in next version

  We decided to cancel this because of the following reasons

  This is a request flow as you mentioned:

  

  Assuming WebApp/SwaggerUI is authenticated and got an access_token and making a request to an endpoint at gateway that automatically redirects to the related microservice (MicroserviceA). In this request, MicroserviceA makes a request to the MicroserviceB using HttpApi.Client and client proxy (or gRPC).

  The problem:

  • The request is done by a user, since it is coming from Web; it is either Hybrid flow or AuthorizationCode flow. What if the user with the permission to make a request to MicroserviceA doesn't have permission for the MicroserviceB? If you grant permission to user (or role the user has), it will cause different problems on the UI.

  Microservice terminology:

  Apart from my explanation to this specific approach, the request flow we are discussing is not Synchronous Communication between Microservices

  This is the synchronous communication between microservices:

  

  No UI, no user information; two servers talking to each other.

  We assume, think or design that microservice with authorization. The oidc standarts for this kind interactions should use client_credentials flow. We have related ABP packages to make it easy to use (Abp.IdentityModel) for it. The problem with authorization is Client_Credentials permission type was in the IdentityServer package which shouldn't be specific to IdentityServer. Client_Credentials is valid for all OIDC providers, so we can simply add it to OpenIddict aswell and keep using it.

  Why do we need access_token in the first place?

  Since the synchronous communication between microservices happens in an internal network and moreover, the microservice-to-microservice request maybe slightly or completely different from a UI request; it is better to use Integration Services without caring about authentication. It will be created for the only purpose to server internal requests.

  Tallentaa Peruuttaa