abp-authorization

name	abp-authorization
description	ABP Framework v10.x (10.4/10.5) authorization: defining permissions (PermissionDefinitionProvider), [Authorize], CheckPolicyAsync/IsGrantedAsync, CurrentUser, IPermissionManager, resource-based auth, multi-tenancy permissions. Use when you need permission, role or access checks in ABP.

ABP Authorization Skill

Trigger

Permissions, authorization, roles, policies, permission groups, resource-based auth, access control.

---

Quick Reference

Define Permissions

public class BookStorePermissionDefinitionProvider : PermissionDefinitionProvider
{
    public override void Define(IPermissionDefinitionContext context)
    {
        var group = context.AddGroup("BookStore", LocalizableString.Create<BookStoreResource>("BookStore"));
        group.AddPermission("BookStore_Author_Create", LocalizableString.Create<BookStoreResource>("Permission:Create"));
    }
}

• Auto-discovered, place in Application.Contracts
• Permission name = ASP.NET Core policy name

Use Permissions

[Authorize("BookStore_Author_Create")]  // Controller/Page
await AuthorizationService.CheckAsync("BookStore_Author_Create");  // App Service

Options

• multiTenancySide: Host | Tenant | Both (default)
• Child permissions: parent.AddChild("Child_Name")
• Feature dependency: .WithFeatureDependency("FeatureName")
• Disabled by default: isEnabled: false

Resource-Based Auth

group.AddResourcePermission("BookStore_Books_Edit", typeof(Book), ...);

Managed per-instance via Resource Permission Management Dialog.

IAuthorizationService

await _authService.CheckAsync("PermissionName");
await _authService.IsGrantedAsync("PermissionName");

Best Practices

• Naming: Module_Entity_Action
• Always localize display names
• Group by module/feature
• Use child perms for CRUD hierarchy
• Set multi-tenancy side explicitly

v10.5+

• Identity token providers are single-active per user/purpose (AbpDefaultTokenProvider, 10-min default lifetime via AbpDefaultTokenProviderOptions/AbpLinkUserTokenProviderOptions). Re-test 2FA, password change, and link-user flows after upgrading.
• OpenIddict default-scope fallback (opt-in): AbpOpenIddictAspNetCoreOptions.UseDefaultScopesForClientCredentials/Password/TokenExchange = true.

Related

Settings & Features · Multi-Tenancy · UI · Exception Handling · Docs: https://abp.io/docs/latest/framework/fundamentals/authorization