Base solution for your next web application
Open Closed

Concurrent Login and TwoFactor Authentication at the User Level #8251


User avatar
0
OutdoorEd created

We are moving from 6.9 to 8.1 ASP.NET Core 3.1 Jquery to take advantage of the new features of both ABP and NetCore 3.1. We have standard CRUD operations happening on the Web App that uses ABP Authentication. We also have built a Blazor Client App for CREATE ONLY operations for Anonymous Users (one ABP User Account that can be logged in to and accessed by multiple people simultaneously).

For the Web App security and the user license count we want to equire 2FA and prevent Concurrent Login, but we want to DISABLE this for the Anonymous User account since we want multiple people to be able to add data without bumping someone else off the system and, since they are Anonymous, we don't have either cellphone number or email and therefore can't use 2FA.

Currently it seems that Concurrent Login and 2FA configuration is only available to the SuperAdmin and applies universally to all Tenants.

How would you implement these at the User Level. Our goal would be the default setting from the Settings/Security screen would be the default and inherited by all Users (and be part of the Create/Edit User screen) so that it could be turned off at the User Account level.


2 Answer(s)
  • User Avatar
    0
    ismcagdas created
    Support Team

    Hi,

    Currently this setting could be Application or Tenant specific. If you want to do it per user, you can first change the setting scope here https://github.com/aspnetzero/aspnet-zero-core/blob/dev/aspnet-core/src/MyCompanyName.AbpZeroTemplate.Core/Configuration/AppSettingProvider.cs#L107 and create a new modal/page to edit this setting for a specific user. In the user list, you can add a new item to user list dropdown menu and open this new modal/page to configure AllowOneConcurrentLoginPerUser for a user.

    If you want to ignore AllowOneConcurrentLoginPerUser for specific user types, you can change the code of login action and ignore this setting if the user's type is Anonymous of phone number is missing etc... according to your bussiness rules.

  • User Avatar
    0
    ismcagdas created
    Support Team

    This issue is closed because of no recent activity. Please open a new issue if you are still having this problem.