abpframework/abp · error · AbpAuthorizationException

Volo.Authorization:010003

Volo.Authorization:010003

Error message

Authorization failed! Given policy has not granted for given resource: {ResourceName}

What it means

Thrown by CheckAsync(this IAuthorizationService, object resource, AuthorizationPolicy policy) when IsGrantedAsync(resource, policy) is false. Error code Volo.Authorization:010003 (GivenPolicyHasNotGrantedForGivenResource), ResourceName attached as data. This is the resource-scoped compiled-policy variant: a policy evaluated against a specific resource instance.

Source

Thrown at framework/src/Volo.Abp.Authorization/Microsoft/AspNetCore/Authorization/AbpAuthorizationServiceExtensions.cs:150

    {
        if (!await authorizationService.IsGrantedAsync(resource, requirement))
        {
            throw new AbpAuthorizationException(code: AbpAuthorizationErrorCodes.GivenRequirementHasNotGrantedForGivenResource)
                .WithData("ResourceName", resource);
        }
    }

    /// <summary>
    /// Checks if CurrentPrincipal meets a specific authorization policy against the specified resource, throwing an <see cref="AbpAuthorizationException"/> if not.
    /// </summary>
    /// <param name="authorizationService">The <see cref="IAuthorizationService"/> providing authorization.</param>
    /// <param name="resource">The resource to evaluate the policy against.</param>
    /// <param name="policy">The policy to evaluate.</param>
    public static async Task CheckAsync(this IAuthorizationService authorizationService, object resource, AuthorizationPolicy policy)
    {
        if (!await authorizationService.IsGrantedAsync(resource, policy))
        {
            throw new AbpAuthorizationException(code: AbpAuthorizationErrorCodes.GivenPolicyHasNotGrantedForGivenResource)
                .WithData("ResourceName", resource);
        }
    }

    /// <summary>
    /// Checks if CurrentPrincipal meets a specific authorization policy, throwing an <see cref="AbpAuthorizationException"/> if not.
    /// </summary>
    /// <param name="authorizationService">The <see cref="IAuthorizationService"/> providing authorization.</param>
    /// <param name="policy">The policy to evaluate.</param>
    public static async Task CheckAsync(this IAuthorizationService authorizationService, AuthorizationPolicy policy)
    {
        if (!await authorizationService.IsGrantedAsync(policy))
        {
            throw new AbpAuthorizationException(code: AbpAuthorizationErrorCodes.GivenPolicyHasNotGranted);
        }
    }

    /// <summary>

View on GitHub (pinned to 7ed43b1931)

Solutions

Verify each requirement in the policy has a matching resource-aware AuthorizationHandler that can Succeed.
Confirm the resource instance matches the handler's TResource type and passes its checks.
Check current principal claims/tenant context against what the handler requires.
Split the policy to isolate which requirement is failing.

Example fix

// before
var policy = new AuthorizationPolicyBuilder().RequireRole("Editor").Build();
await AuthorizationService.CheckAsync(doc, policy); // throws 010003
// after: ensure user is Editor AND owns doc via a combined handler

Defensive patterns

Strategy: validation

Validate before calling

if (!await authorizationService.IsGrantedAsync(resource, compiledPolicy))
{
    // return 403 for this resource instead of throwing
}

Type guard

null

Try / catch

try { await authorizationService.CheckAsync(resource, policy); }
catch (AbpAuthorizationException ex) when (ex.Code == "Volo.Authorization:010003")
{ /* handle forbidden for this resource/policy */ }

Prevention

Ensure each requirement in the policy has a resource-aware handler.
Confirm the resource type matches the handler's TResource.
Test policies requirement-by-requirement to isolate failures.
Prefer named policies for simpler diagnostics where possible.

When it happens

Trigger: Calling authorizationService.CheckAsync(resource, compiledPolicy) where the policy's requirements, evaluated against that resource, do not succeed for the current principal.

Common situations: Policy combines multiple requirements and one fails for the resource; resource instance is from a different tenant/owner; policy built from the wrong requirements; handler registered as a non-resource handler so it never matches.

Related errors

AI-assisted analysis of abpframework/abp@7ed43b1931 (2026-08-13). Data as JSON: /api/errors/e3db2ad6ef353676. Report an issue: GitHub.