Hello Support Team,

As per the IdentityServer4 documentation, there will be no Security update after November 2022. They are shifting to the new company, and the licenses are very expensive. are you planning to provide any alternative for this?

https://identityserver4.readthedocs.io/en/latest/

Thanks

Hi @ismcagdas, We have fixed this issue by overwrite the ABPHttpInterceptor function name Intercept. In this function, by default some custom headers are added by the NormalizeRequestHeaders function which creating the problem for keycloak access token request. Now we filter our request bypass from the NormalizeRequestHeaders function then it works, and we got the access token from Keycloak. Is there any alternate and best solution for this?

Like below example code:

protected normalizeRequestHeaders(request: HttpRequest<any>): HttpRequest<any> { var modifiedHeaders = new HttpHeaders(); if({Filter http request by custom param}) { return request; } else { modifiedHeaders = request.headers.set("Pragma", "no-cache") .set("Cache-Control", "no-cache") .set("Expires", "Sat, 01 Jan 2000 00:00:00 GMT"); modifiedHeaders = this.addXRequestedWithHeader(modifiedHeaders); modifiedHeaders = this.addAuthorizationHeaders(modifiedHeaders); modifiedHeaders = this.addAspNetCoreCultureHeader(modifiedHeaders); modifiedHeaders = this.addAcceptLanguageHeader(modifiedHeaders); modifiedHeaders = this.addTenantIdHeader(modifiedHeaders); return request.clone({ headers: modifiedHeaders }); } }

• What is your product version?

• 11.3.0

• What is your product type (Angular or MVC)?

• Angular

• What is the product framework type (.net framework or .net core)?

• .net core

• What is the ABP Framework version?

• 7.3

Issue:

We are using multiple social external login providers. When attempting to register with the deleted users again, we are having trouble. These are the actions that we took.

1. Using [email protected] as the user's first external social login (KeyClock). In addition to creating a new external provider in the AbpUserLogins table, it also generates a new user in the AbpUsers table.
2. The user is operating without any problems.
3. The administrator removed [email protected] from the manage users page. The AbpUsers table indicated that the user had been softly deleted.
4. Attempt to register the same user ([email protected]) once more using the same external login service (KeyClock).
5. An internal server error is thrown. We cannot register the same user more than once.

Solution:

Because the provider key is unique and the application prevents the creation of the same provider key, according to our analysis, we must delete the same user from the AbpUserLogins table. For the time being, we're going to use a method that deletes users simultaneously from the AbpUsers and the AbpUserLogins (Step 3 from above steps) tables.

Is this the best option, or should the AbpUserLogins table's soft deletion be enabled instead?

Github ticket: https://github.com/aspnetzero/aspnet-zero-core/issues/4696