abpframework/abp · error · AbpAuthorizationException

Volo.Authorization:010002

Volo.Authorization:010002

Error message

Authorization failed! Given policy has not granted: {PolicyName}

What it means

Thrown by the CheckAsync(this IAuthorizationService, string policyName) extension when IsGrantedAsync(policyName) returns false for the current principal. The error code is Volo.Authorization:010002 (GivenPolicyHasNotGrantedWithPolicyName) and carries PolicyName as exception data. It is the named-policy variant of ABP's authorization check helpers.

Source

Thrown at framework/src/Volo.Abp.Authorization/Microsoft/AspNetCore/Authorization/AbpAuthorizationServiceExtensions.cs:120

    {
        return (await authorizationService.AuthorizeAsync(resource, requirements)).Succeeded;
    }

    public static async Task<bool> IsGrantedAsync(this IAuthorizationService authorizationService, object resource, string policyName)
    {
        return (await authorizationService.AuthorizeAsync(resource, policyName)).Succeeded;
    }

    /// <summary>
    /// Checks if CurrentPrincipal meets a specific authorization policy, throwing an <see cref="AbpAuthorizationException"/> if not.
    /// </summary>
    /// <param name="authorizationService">The <see cref="IAuthorizationService"/> providing authorization.</param>
    /// <param name="policyName">The name of the policy to evaluate.</param>
    public static async Task CheckAsync(this IAuthorizationService authorizationService, string policyName)
    {
        if (!await authorizationService.IsGrantedAsync(policyName))
        {
            throw new AbpAuthorizationException(code: AbpAuthorizationErrorCodes.GivenPolicyHasNotGrantedWithPolicyName)
                .WithData("PolicyName", policyName);
        }
    }

    /// <summary>
    /// Checks if CurrentPrincipal meets a specific requirement for the specified resource, throwing an <see cref="AbpAuthorizationException"/> if not.
    /// </summary>
    /// <param name="authorizationService">The <see cref="IAuthorizationService"/> providing authorization.</param>
    /// <param name="resource">The resource to evaluate the policy against.</param>
    /// <param name="requirement">The requirement to evaluate the policy against.</param>
    public static async Task CheckAsync(this IAuthorizationService authorizationService, object resource, IAuthorizationRequirement requirement)
    {
        if (!await authorizationService.IsGrantedAsync(resource, requirement))
        {
            throw new AbpAuthorizationException(code: AbpAuthorizationErrorCodes.GivenRequirementHasNotGrantedForGivenResource)
                .WithData("ResourceName", resource);
        }
    }

View on GitHub (pinned to 7ed43b1931)

Solutions

Grant the missing permission/role to the user for the current tenant via the permission management API.
Verify the policy name string exactly matches a defined policy/permission.
Check the current principal/claims and tenant context are what you expect (ICurrentUser, CurrentTenant).
Confirm the relevant PermissionDefinitionProvider / AuthorizationPolicy is registered.

Example fix

// before
await AuthorizationService.CheckAsync("MyApp.Orders.Export"); // throws 010002
// after: grant the permission to the user's role
await PermissionManager.SetForRoleAsync(roleName, "MyApp.Orders.Export", true);

Defensive patterns

Strategy: validation

Validate before calling

if (!await authorizationService.IsGrantedAsync("MyPolicy"))
{
    // return 403 or hide the feature instead of letting CheckAsync throw
}

Type guard

null

Try / catch

try { await authorizationService.CheckAsync("MyPolicy"); }
catch (AbpAuthorizationException ex) when (ex.Code == "Volo.Authorization:010002")
{ /* handle forbidden; ex.Data["PolicyName"] has the policy */ }

Prevention

Use IsGrantedAsync to gate UI/feature visibility before calling CheckAsync.
Keep permission/policy names in constants to avoid typos.
Verify the PermissionDefinitionProvider registers every named policy you check.
Confirm tenant context when granting permissions.

When it happens

Trigger: Calling authorizationService.CheckAsync("MyPolicy") (or any ABP code path that resolves a named policy requirement) where the current user's principal does not satisfy that policy's requirements.

Common situations: User lacks the permission/role the policy requires; policy name typo means it resolves to a policy that always denies; permission granted to a different role; multi-tenant context where the permission isn't granted for the current tenant; missing PermissionDefinitionProvider registration.

Related errors

AI-assisted analysis of abpframework/abp@7ed43b1931 (2026-08-13). Data as JSON: /api/errors/01bac4e94daf77cf. Report an issue: GitHub.