Identity Management

Yes, it automatically handles the token refresh.

From the (Microsoft Documentation):

Acquiring tokens silently (from the cache)

MSAL maintains a token cache (or two caches for confidential client applications) and caches a token after it's been acquired. In many cases, attempting to silently get a token will acquire another token with more scopes based on a token in the cache. It's also capable of refreshing a token when it's getting close to expiration (as the token cache also contains a refresh token).

Ok looks like I just need to create an "Admin" role and make it my default role for each tennet

https://github.com/abpframework/abp/issues/10995

You can configure Azure AD B2C to allow users to sign in to your application with credentials from external identity providers like Facebook, Google and GitHub.

Google One Tap is part of Google Identity Service, it's a type of Google Authentication without using password and we can use Google Identity Service along side with Azure AD B2C.

• First we need to to register Google as an identity provider for your Azure AD B2C tenant, as described in this document.

• You need to create a sign-up or sign-in policy, as described at Azure Active Directory B2C: Built-in policies, and add Google as an identity provider for this policy.

Check this example of using Google Identity Provider with Azure AD B2C for more information.

You could make use of database transactions. You could create a database connection and open it.. The first line should be BEGIN TRANSACTION. This means any subsequent SQL INSERTS/UPDATES you execute wont be commited until you run the statement COMMIT TRANSACTION.. If you want to roll back the transaction you would call ROLLBACK TRANACTION.

So you could:

If the SQL statement succeeds, you know the databse is up and accessible and this step has succeeded. It just that the row has not been commited to the database yet.

That way:

• If the SQL statement fails in any way (DB down, T-SQL error, etc), you exit early
• If the API call fails in any way, you exit early
• You only commit the SQL statement when the INSERT and the API succeeds

If the COMMIT Fails

Now there might be a slim chance the COMMIT fails due to power loss or network outage at that second, etc.. In that case you you would need to call the API to remove/deactivate the user you just created.

Use the authentication library to pass in a value for the “state” parameter. This parameter will be returned in the authentication response to your application.

Encode a value which represents the location of where the user was on the website, and put it in the “state” parameter.

After the user logs in, have the application parse the state parameter and send the user to the correct location.

https://docs.microsoft.com/en-us/azure/active-directory-b2c/openid-connect#send-authentication-requests

Doesn't global admin has global rights and can do this?

No. You're global admin in your Azure AD so you can perform all operations in Azure AD. Azure AD roles are different than Azure Subscription roles.

To be able to perform IAM related activities in an Azure Subscription, you must be assigned an Owner or User Access Administrator role in that Azure Subscription.

Considering you're the global admin in your Azure AD, you can elevate your permissions to perform IAM activities in Azure Subscription. Please see this link for more details: https://docs.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin.

Other option would be to ask someone in your team with proper access in the Azure Subscription to assign you in Owner or User Access Administrator role.

See Abp Localization Docs

1. Extend an existing resource JSON file

   • zh-Hans

• en

A ledger stores facts about the history of transactions that led to the current state of an object. The history also stores the users responsible for the current state of the object. If the state of an object is being changed, the admin/authorized user of an organization must be able to see who performed that change.

In the first approach, if you want to see the details of the user doing the "transaction", you'll have to store it somewhere different from the blockchain. While that can be a use-case of your project, it defeats the purpose of storing all facts about the history of a transaction of an object as every time the same user would be doing the transaction.

The second approach fulfills all the motives of incorporating blockchain in a project. Sure, you'll have to register and enroll every user who's creating/modifying an asset but then Access Control Management can be done in a better way. Please read about ACL to know about the granular access you can achieve in Hyperledger Fabric.

Also, you can also encode some information about a user in its x509 certificate with ASN.1

I was in deep conversations with AWS SES support regarding this issue. This is the outcome:

I also would like to update you that SES internal team were able to confirm a deliverability issue with the recipient ISP and are actively working towards a resolution but we do not have an exact ETA at this time. Due to the nature of the shared IP pool, these types of blocks can happen periodically and we make every effort to resolve these issues as fast as possible. To prevent impact from these types of issues, it is always recommended to use dedicated ips for higher volume sending.

It means that the shared IP addresses used by AWS SES are blacklisted with GMX and WEB.de AWS SES wants to resolve this.

In the meantime, they recommend to use dedicated IP addresses to solve this issue. Please note that these IP addresses have to be "warmed up" in order to not cause trouble on the recipient end (e.g. spam folder issues). Unfortunately, my sending volume is not that high (yet) so I have my fingers crossed I can get those emails send out easily. Otherwise I have to find another solution or need to wait for AWS so solve the blacklist issue. I hope this helps anyone else.