What causes "Product management authorization is required." in dotnet/orleans?

Ensure the caller authenticates and the token carries the claim/role the ProductManagement policy requires.

dotnet/orleans · error · UnauthorizedAccessException

Product management authorization is required.

Error message

Product management authorization is required.

What it means

An UnauthorizedAccessException thrown by ProductService.CreateOrUpdateProductAsync when ASP.NET Core's IAuthorizationService.AuthorizeAsync against the 'ProductManagement' policy returns Succeeded == false. The grain call is gated behind authorization, so an unauthenticated or under-privileged caller is refused before any grain mutation occurs.

Source

Thrown at samples/Deployment/AzureAppService/Silo/Services/ProductService.cs:19

// Copyright (c) Microsoft. All rights reserved.
// Licensed under the MIT License.

namespace Orleans.ShoppingCart.Silo.Services;

public sealed class ProductService(
    IClusterClient client,
    IAuthorizationService authorizationService)
{
    public async Task CreateOrUpdateProductAsync(
        ClaimsPrincipal user,
        ProductDetails product)
    {
        var authorizationResult = await authorizationService.AuthorizeAsync(
            user,
            AuthorizationPolicies.ProductManagement);
        if (!authorizationResult.Succeeded)
        {
            throw new UnauthorizedAccessException(
                "Product management authorization is required.");
        }

        await client.GetGrain<IProductGrain>(product.Id).CreateOrUpdateProductAsync(product);
    }
}

View on GitHub (pinned to fca799fa70)

Solutions

Ensure the caller authenticates and the token carries the claim/role the ProductManagement policy requires.
Verify the AuthorizationPolicies.ProductManagement registration and the authentication scheme are wired in Program.cs.
Decorate the calling endpoint/controller with [Authorize(Policy = ...)] so failures are handled by the auth middleware (401/403) rather than a thrown exception.

Example fix

// before
var authorizationResult = await authorizationService.AuthorizeAsync(user, AuthorizationPolicies.ProductManagement);
if (!authorizationResult.Succeeded)
    throw new UnauthorizedAccessException("Product management authorization is required.");

// after (return a 403-friendly result instead of throwing)
var authorizationResult = await authorizationService.AuthorizeAsync(user, AuthorizationPolicies.ProductManagement);
if (!authorizationResult.Succeeded)
    return Results.Forbid();

Defensive patterns

Strategy: validation

Validate before calling

var authResult = await authorizationService.AuthorizeAsync(user, AuthorizationPolicies.ProductManagement);
if (!authResult.Succeeded) return Results.Forbid();

Prevention

Require [Authorize(Policy = AuthorizationPolicies.ProductManagement)] on the endpoint so the middleware returns 401/403 cleanly.
Verify the policy registration and the authentication scheme are wired in Program.cs.
Ensure tokens carry the role/claim the policy demands.

When it happens

Trigger: A request to create/update a product arrives with a ClaimsPrincipal that does not satisfy the ProductManagement authorization policy (e.g., missing the required role/claim, or anonymous). authorizationResult.Succeeded is false.

Common situations: The caller's token lacks the product-management role/claim. The authorization policy is misconfigured (wrong scheme, missing role mapping). The endpoint isn't requiring authentication so the principal is anonymous.

Related errors

AI-assisted analysis of dotnet/orleans@fca799fa70 (2026-08-13). Data as JSON: /api/errors/956a80f1b3e9955d. Report an issue: GitHub.