| name | abp-authorization |
| description | ABP Framework v10.x (10.4/10.5) authorization: defining permissions (PermissionDefinitionProvider), [Authorize], CheckPolicyAsync/IsGrantedAsync, CurrentUser, IPermissionManager, resource-based auth, multi-tenancy permissions. Use when you need permission, role or access checks in ABP. |
ABP Authorization Skill
Trigger
Permissions, authorization, roles, policies, permission groups, resource-based auth, access control.
Quick Reference
Define Permissions
public class BookStorePermissionDefinitionProvider : PermissionDefinitionProvider
{
public override void Define(IPermissionDefinitionContext context)
{
var group = context.AddGroup("BookStore", LocalizableString.Create<BookStoreResource>("BookStore"));
group.AddPermission("BookStore_Author_Create", LocalizableString.Create<BookStoreResource>("Permission:Create"));
}
}
- Auto-discovered, place in
Application.Contracts
- Permission name = ASP.NET Core policy name
Use Permissions
[Authorize("BookStore_Author_Create")]
await AuthorizationService.CheckAsync("BookStore_Author_Create");
Options
multiTenancySide: Host | Tenant | Both (default)
- Child permissions:
parent.AddChild("Child_Name")
- Feature dependency:
.WithFeatureDependency("FeatureName")
- Disabled by default:
isEnabled: false
Resource-Based Auth
group.AddResourcePermission("BookStore_Books_Edit", typeof(Book), ...);
Managed per-instance via Resource Permission Management Dialog.
IAuthorizationService
await _authService.CheckAsync("PermissionName");
await _authService.IsGrantedAsync("PermissionName");
Best Practices
- Naming:
Module_Entity_Action
- Always localize display names
- Group by module/feature
- Use child perms for CRUD hierarchy
- Set multi-tenancy side explicitly
v10.5+
- Identity token providers are single-active per user/purpose (
AbpDefaultTokenProvider, 10-min default lifetime via AbpDefaultTokenProviderOptions/AbpLinkUserTokenProviderOptions). Re-test 2FA, password change, and link-user flows after upgrading.
- OpenIddict default-scope fallback (opt-in):
AbpOpenIddictAspNetCoreOptions.UseDefaultScopesForClientCredentials/Password/TokenExchange = true.
Related
Settings & Features · Multi-Tenancy · UI · Exception Handling · Docs: https://abp.io/docs/latest/framework/fundamentals/authorization