StrictSecurityPermissionAuthorizationHandler is not getting Permissions (O.C 2.1.7)

[KamranMammadov]

Hi all,

I'm encountering an issue with the StrictSecurityPermissionAuthorizationHandler after upgrading Orchard Core to the latest version. Specifically, I'm receiving an error when trying to access content types that have "StrictSecurity" enabled.

The root cause seems to be that the user's permissions are not being found in the claims, which results in the authorization check failing:

      var permissionNames = context
          .User
          .Claims
          .Where(claim => claim.Type == nameof(Permission))
          .Select(claim => claim.Value);

      if (!permissionNames.Any(claims.Contains)) context.Fail();

[Piedone]

Sorry for replying just now.

Isn't this for users who have roles that previously contained the Site Owner permission? Because that changed in 2.1: https://docs.orchardcore.net/en/latest/releases/2.1.0/#site-owner-permission-deprecated-administrator-role-retained-as-a-system-role After that, you'll need to add a role to these users which indeed contains the exact permission for the given content type.