Validate parent organization unit tenant on create and move

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/IdentityErrorCodes.cs

@@ -11,6 +11,7 @@ public static class IdentityErrorCodes
     public const string UsersCanNotChangeTwoFactor = "Volo.Abp.Identity:010007";
     public const string CanNotChangeTwoFactor = "Volo.Abp.Identity:010008";
     public const string YouCannotDelegateYourself = "Volo.Abp.Identity:010009";
+    public const string OrganizationUnitParentTenantMismatch = "Volo.Abp.Identity:010010";
     public const string ClaimNameExist = "Volo.Abp.Identity:010021";
     public const string CanNotUpdateStaticClaimType = "Volo.Abp.Identity:010022";
     public const string CanNotDeleteStaticClaimType = "Volo.Abp.Identity:010023";

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/ar.json

@@ -77,6 +77,7 @@
     "Volo.Abp.Identity:010007": "لا يمكنك تغيير إعداد العاملين.",
     "Volo.Abp.Identity:010008": "لا يجوز تغيير إعداد عاملين.",
     "Volo.Abp.Identity:010009": "لا يمكنك تفويض نفسك.",
+    "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.",
     "Volo.Abp.Identity:010021": "الاسم {0} موجود بالفعل.",
     "Volo.Abp.Identity:010022": "لا يمكن تحديث نوع المطابقة.",
     "Volo.Abp.Identity:010023": "لا يمكن حذف نوع المطابقة.",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/cs.json

@@ -77,6 +77,7 @@
     "Volo.Abp.Identity:010007": "Nastavení dvou faktorů nemůžete změnit.",
     "Volo.Abp.Identity:010008": "Není povoleno měnit nastavení dvou faktorů.",
     "Volo.Abp.Identity:010009": "Nemůžete delegovat své vlastní oprávnění.",
+    "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.",
     "Volo.Abp.Identity:010021": "Název '{0}' již existuje.",
     "Volo.Abp.Identity:010022": "Nelze aktualizovat statický typ deklarace.",
     "Volo.Abp.Identity:010023": "Nelze smazat statický typ deklarace.",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/de.json

@@ -77,6 +77,7 @@
     "Volo.Abp.Identity:010007": "Sie können Ihre Zwei-Faktor-Einstellung nicht ändern.",
     "Volo.Abp.Identity:010008": "Die Zwei-Faktor-Einstellung dürfen nicht geändert werden.",
     "Volo.Abp.Identity:010009": "Sie können sich nicht selbst delegieren.",
+    "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.",
     "Volo.Abp.Identity:010021": "Der Name existiert bereits {0}",
     "Volo.Abp.Identity:010022": "Der Name kann nicht aktualisiert werden.",
     "Volo.Abp.Identity:010023": "Der Name kann nicht gelöscht werden.",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/el.json

@@ -76,6 +76,7 @@
     "Volo.Abp.Identity:010007": "Δεν μπορείτε να αλλάξετε τη ρύθμιση δύο παραγόντων.",
     "Volo.Abp.Identity:010008": "Δεν επιτρέπεται η αλλαγή της ρύθμισης δύο παραγόντων.",
     "Volo.Abp.Identity:010009": "Δεν μπορείτε να αναθέσετε την εξουσιοδότησή σας σε εσάς ίδιο.",
+    "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.",
     "Volo.Abp.Identity:010021": "Το όνομα '{0}' υπάρχει ήδη.",
     "Volo.Abp.Identity:010022": "Δεν μπορείτε να ενημερώσετε ένα στατικό τύπο δήλωσης.",
     "Volo.Abp.Identity:010023": "Δεν μπορείτε να διαγράψετε ένα στατικό τύπο δήλωσης.",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/en-GB.json

@@ -76,6 +76,7 @@
     "Volo.Abp.Identity:010007": "You can't change your two factor setting.",
     "Volo.Abp.Identity:010008": "Changing the two factor setting is not allowed.",
     "Volo.Abp.Identity:010009": "You cannot delegate yourself!",
+    "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.",
     "Volo.Abp.Identity:010021": "Name exist: '{0}'",
     "Volo.Abp.Identity:010022": "Can not update a static ClaimType.",
     "Volo.Abp.Identity:010023": "Can not delete a static ClaimType.",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/en.json

@@ -77,6 +77,7 @@
     "Volo.Abp.Identity:010007": "You can't change your two factor setting.",
     "Volo.Abp.Identity:010008": "It's not allowed to change two factor setting.",
     "Volo.Abp.Identity:010009": "You can not delegate yourself.",
+    "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.",
     "Volo.Abp.Identity:010021": "Name exist: '{0}'.",
     "Volo.Abp.Identity:010022": "Can not update a static ClaimType.",
     "Volo.Abp.Identity:010023": "Can not delete a static ClaimType.",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/es.json

@@ -77,6 +77,7 @@
     "Volo.Abp.Identity:010007": "No puedes cambiar tu configuración de autentificación de dos pasos.",
     "Volo.Abp.Identity:010008": "No está permitido cambiar la configuración de autenticación de dos pasos.",
     "Volo.Abp.Identity:010009": "No puedes delegar tu propia cuenta!",
+    "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.",
     "Volo.Abp.Identity:010021": "Ya existe un con el nombre '{0}'",
     "Volo.Abp.Identity:010022": "No se puede actualizar un tipo de reclamación estática.",
     "Volo.Abp.Identity:010023": "No se puede borrar un tipo de reclamación estática.",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/fa.json

@@ -77,6 +77,7 @@
     "Volo.Abp.Identity:010007": "شما نمی توانید تنظیمات دو مرحله ای خود را تغییر دهید.",
     "Volo.Abp.Identity:010008": "تغییر دادن تنظیمات دو مرحله ای مجاز نمی باشد.",
     "Volo.Abp.Identity:010009": "شما نمی توانید خودتان را معرفی کنید.",
+    "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.",
     "Volo.Abp.Identity:010021": "نام {0} قبلاً استفاده گردیده است.",
     "Volo.Abp.Identity:010022": "نمی توان نام نقش/وظیفه را تغییر داد.",
     "Volo.Abp.Identity:010023": "نمی توان نقش/وظیفه را حذف کرد.",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/fi.json

@@ -77,6 +77,7 @@
     "Volo.Abp.Identity:010007": "Et voi muuttaa kahden tekijän asetusta.",
     "Volo.Abp.Identity:010008": "Kahden tekijän asetusta ei saa muuttaa.",
     "Volo.Abp.Identity:010009": "Et voi delegoida itseäsi.",
+    "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.",
     "Volo.Abp.Identity:010021": "{0} on jo olemassa.",
     "Volo.Abp.Identity:010022": "Staattista väittämätunnusta ei voi päivittää.",
     "Volo.Abp.Identity:010023": "Staattista väittämätunnusta ei voi poistaa.",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/fr.json

@@ -77,6 +77,7 @@
     "Volo.Abp.Identity:010007": "Vous ne pouvez pas modifier votre paramètre à deux facteurs.",
     "Volo.Abp.Identity:010008": "Il n’est pas permis de changer deux facteurs de réglage.",
     "Volo.Abp.Identity:010009": "Vous ne pouvez pas vous déléguer vous-même.",
+    "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.",
     "Volo.Abp.Identity:010021": "Le nom '{0}' existe déjà.",
     "Volo.Abp.Identity:010022": "Vous ne pouvez pas modifier un type de revendication statique.",
     "Volo.Abp.Identity:010023": "Vous ne pouvez pas supprimer un type de revendication statique.",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/hi.json

@@ -77,6 +77,7 @@
     "Volo.Abp.Identity:010007": "आप अपनी दो कारक सेटिंग नहीं बदल सकते।",
     "Volo.Abp.Identity:010008": "इसे दो कारक सेटिंग बदलने की अनुमति नहीं है।",
     "Volo.Abp.Identity:010009": "आप अपने आप को अधिकृत नहीं कर सकते हैं!",
+    "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.",
     "Volo.Abp.Identity:010021": "नाम '{0}' पहले से ही लिया गया है।",
     "Volo.Abp.Identity:010022": "स्थैतिक भूमिकाओं का नाम नहीं बदला जा सकता है।",
     "Volo.Abp.Identity:010023": "स्थैतिक भूमिकाओं को हटाया नहीं जा सकता।",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/hr.json

@@ -77,6 +77,7 @@
     "Volo.Abp.Identity:010007": "Ne možete promijeniti postavku dva faktora.",
     "Volo.Abp.Identity:010008": "Nije dopušteno mijenjati postavke dvofaktorske autentifikacije.",
     "Volo.Abp.Identity:010009": "Ne možete delegirati sami sebi.",
+    "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.",
     "Volo.Abp.Identity:010021": "Naziv '{0}' već postoji.",
     "Volo.Abp.Identity:010022": "Ne možete ažurirati statički tip deklaracije.",
     "Volo.Abp.Identity:010023": "Ne možete izbrisati statički tip deklaracije.",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/hu.json

@@ -77,6 +77,7 @@
     "Volo.Abp.Identity:010007": "Nem változtathatja meg a kétlépcsős bejelentkezés beállítását.",
     "Volo.Abp.Identity:010008": "Kétlépcsős bejelentkezés beállítás megváltoztatása nem megengedett.",
     "Volo.Abp.Identity:010009": "Nem adhatja át a saját jogosultságait.",
+    "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.",
     "Volo.Abp.Identity:010021": "'{0}' nevű már létezik.",
     "Volo.Abp.Identity:010022": "Nem lehet frissíteni a statikus jogosultság típusát.",
     "Volo.Abp.Identity:010023": "Nem lehet törölni a statikus jogosultság típusát.",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/is.json

@@ -77,6 +77,7 @@
     "Volo.Abp.Identity:010007": "Þú getur ekki breytt tveggja þátta stillingu þinni.",
     "Volo.Abp.Identity:010008": "Það er ekki leyfilegt að breyta tvíþátta stillingu.",
     "Volo.Abp.Identity:010009": "Þú getur ekki delegað þér sjálfum.",
+    "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.",
     "Volo.Abp.Identity:010021": "Nafnið '{0}' er þegar í notkun.",
     "Volo.Abp.Identity:010022": "Ekki er hægt að breyta static hlutverk.",
     "Volo.Abp.Identity:010023": "Ekki er hægt að eyða static hlutverkum.",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/it.json

@@ -77,6 +77,7 @@
     "Volo.Abp.Identity:010007": "Non puoi modificare l'impostazione dei due fattori.",
     "Volo.Abp.Identity:010008": "Non è consentito modificare l'impostazione a due fattori.",
     "Volo.Abp.Identity:010009": "Non puoi delegare te stesso.",
+    "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.",
     "Volo.Abp.Identity:010021": "Il nome '{0}' è già in uso.",
     "Volo.Abp.Identity:010022": "Non puoi modificare il tipo di richiesta statica.",
     "Volo.Abp.Identity:010023": "Non puoi eliminare il tipo di richiesta statica.",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/nl.json

@@ -77,6 +77,7 @@
     "Volo.Abp.Identity:010007": "U kunt uw instelling voor tweefactor authenticatie niet wijzigen.",
     "Volo.Abp.Identity:010008": "Het is niet toegestaan om de instelling van tweefactor authenticatie te wijzigen.",
     "Volo.Abp.Identity:010009": "U kunt uzelf niet delegeren.",
+    "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.",
     "Volo.Abp.Identity:010021": "Er bestaat al een met de naam '{0}'.",
     "Volo.Abp.Identity:010022": "Kan de naam van een statische claim niet wijzigen.",
     "Volo.Abp.Identity:010023": "Kan de naam van een statische claim niet verwijderen.",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/pl-PL.json

@@ -77,6 +77,7 @@
     "Volo.Abp.Identity:010007": "Nie możesz zmienić ustawienia dwóch czynników.",
     "Volo.Abp.Identity:010008": "Nie wolno zmieniać ustawienia dwuczynnikowego.",
     "Volo.Abp.Identity:010009": "Nie możesz delegować swoich uprawnień.",
+    "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.",
     "Volo.Abp.Identity:010021": "Nazwa '{0}' już istnieje.",
     "Volo.Abp.Identity:010022": "Nie można zmienić typu statycznej deklaracji.",
     "Volo.Abp.Identity:010023": "Nie można usunąć typu statycznej deklaracji.",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/pt-BR.json

@@ -77,6 +77,7 @@
     "Volo.Abp.Identity:010007": "Você não pode alterar sua configuração de dois fatores.",
     "Volo.Abp.Identity:010008": "Não é permitido alterar a configuração de dois fatores.",
     "Volo.Abp.Identity:010009": "Você não pode delegar a si mesmo.",
+    "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.",
     "Volo.Abp.Identity:010021": "Já existe um(a) {0} com o nome.",
     "Volo.Abp.Identity:010022": "Não é possível alterar o tipo de declaração estática.",
     "Volo.Abp.Identity:010023": "Não é possível excluir o tipo de declaração estática.",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/ro-RO.json

@@ -77,6 +77,7 @@
     "Volo.Abp.Identity:010007": "Nu vă puteţi schimba setările de autentificare în doi paşi.",
     "Volo.Abp.Identity:010008": "Nu este permisă modificarea setărilor autentificării în doi paşi.",
     "Volo.Abp.Identity:010009": "Nu vă puteţi delega singur.",
+    "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.",
     "Volo.Abp.Identity:010021": "Numele '{0}' este deja luat.",
     "Volo.Abp.Identity:010022": "Nu poate fi schimbată tipul de declaraţie statică.",
     "Volo.Abp.Identity:010023": "Nu poate fi ştersă declaraţia statică.",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/ru.json

@@ -77,6 +77,7 @@
     "Volo.Abp.Identity:010007": "Вы не можете изменить настройку двух факторов.",
     "Volo.Abp.Identity:010008": "Изменение двухфакторной настройки не допускается.",
     "Volo.Abp.Identity:010009": "Вы не можете делегировать свои собственные права.",
+    "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.",
     "Volo.Abp.Identity:010021": "Имя '{0}' уже существует.",
     "Volo.Abp.Identity:010022": "Невозможно изменить тип статической декларации.",
     "Volo.Abp.Identity:010023": "Невозможно удалить тип статической декларации.",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/sk.json

@@ -77,6 +77,7 @@
     "Volo.Abp.Identity:010007": "Dvojfaktorové nastavenie nie je možné zmeniť.",
     "Volo.Abp.Identity:010008": "Dvojfaktorové nastavenie nie je povolené zmeniť.",
     "Volo.Abp.Identity:010009": "Nemôžete delegovať svoje vlastné oprávnenia.",
+    "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.",
     "Volo.Abp.Identity:010021": "Názov '{0}' sa už používa.",
     "Volo.Abp.Identity:010022": "Nie je možné zmeniť typ statického oprávnenia.",
     "Volo.Abp.Identity:010023": "Nie je možné odstrániť typ statického oprávnenia.",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/sl.json

@@ -77,6 +77,7 @@
     "Volo.Abp.Identity:010007": "Nastavitve dveh faktorjev ne morete spremeniti.",
     "Volo.Abp.Identity:010008": "Ni dovoljeno spreminjati nastavitve dveh faktorjev.",
     "Volo.Abp.Identity:010009": "Ne morete delegirati svojih pravic.",
+    "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.",
     "Volo.Abp.Identity:010021": "Naziv '{0}' že obstaja.",
     "Volo.Abp.Identity:010022": "Ne morete spremeniti tipa statične deklaracije.",
     "Volo.Abp.Identity:010023": "Ne morete izbrisati tipa statične deklaracije.",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/sv.json

@@ -77,6 +77,7 @@
     "Volo.Abp.Identity:010007": "Du kan inte ändra din tvåfaktorsinställning.",
     "Volo.Abp.Identity:010008": "Det är inte tillåtet att ändra inställningen för två faktorer.",
     "Volo.Abp.Identity:010009": "Du kan inte delegera dig själv.",
+    "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.",
     "Volo.Abp.Identity:010021": "Namn finns: '{0}'.",
     "Volo.Abp.Identity:010022": "Kan inte ändra statiskt område.",
     "Volo.Abp.Identity:010023": "Kan inte ta bort statiskt område.",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/tr.json

@@ -77,6 +77,7 @@
     "Volo.Abp.Identity:010007": "İki faktörlü ayarınızı değiştiremezsiniz.",
     "Volo.Abp.Identity:010008": "İki faktörlü ayarın değiştirilmesine izin verilmez.",
     "Volo.Abp.Identity:010009": "Kendinizi yetkilendiremezsiniz.",
+    "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.",
     "Volo.Abp.Identity:010021": "{0} isminde bir birim zaten var.",
     "Volo.Abp.Identity:010022": "Bir statik izin tipi değiştirilemez.",
     "Volo.Abp.Identity:010023": "Bir statik izin tipi silinemez.",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/vi.json

@@ -77,6 +77,7 @@
     "Volo.Abp.Identity:010007": "Bạn không thể thay đổi cài đặt hai yếu tố của mình.",
     "Volo.Abp.Identity:010008": "Không được phép thay đổi cài đặt hai yếu tố.",
     "Volo.Abp.Identity:010009": "Bạn không thể ủy quyền cho chính mình.",
+    "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.",
     "Volo.Abp.Identity:010021": "Tên '{0}' đã tồn tại.",
     "Volo.Abp.Identity:010022": "Không thể thay đổi kiểu của phát biểu tĩnh.",
     "Volo.Abp.Identity:010023": "Không thể xóa phát biểu tĩnh.",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/zh-Hans.json

@@ -77,6 +77,7 @@
     "Volo.Abp.Identity:010007": "你不能修改你的双因素身份验证设置",
     "Volo.Abp.Identity:010008": "不允许修改双因素身份验证设置。",
     "Volo.Abp.Identity:010009": "你不能委托给自己。",
+    "Volo.Abp.Identity:010010": "父组织单元 ('{ParentId}') 在当前租户中不存在.",
     "Volo.Abp.Identity:010021": "名称：'{0}' 已存在",
     "Volo.Abp.Identity:010022": "不能更改静态声明的类型。",
     "Volo.Abp.Identity:010023": "不能删除静态声明的类型。",

modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/zh-Hant.json

@@ -77,6 +77,7 @@
     "Volo.Abp.Identity:010007": "你不能修改你的雙因素身份驗證設置",
     "Volo.Abp.Identity:010008": "不允許修改雙因素身份驗證設置.",
     "Volo.Abp.Identity:010009": "你不能委派給自己",
+    "Volo.Abp.Identity:010010": "父組織單元 ('{ParentId}') 在目前的租戶中不存在.",
     "Volo.Abp.Identity:010021": "名稱 '{0}' 已存在.",
     "Volo.Abp.Identity:010022": "無法更改靜態宣告的類型.",
     "Volo.Abp.Identity:010023": "無法刪除靜態宣告的類型.",

modules/identity/src/Volo.Abp.Identity.Domain/Volo/Abp/Identity/OrganizationUnitManager.cs

@@ -41,6 +41,8 @@ public class OrganizationUnitManager : DomainService
     [UnitOfWork]
     public virtual async Task CreateAsync(OrganizationUnit organizationUnit)
     {
+        await ValidateParentTenantAsync(organizationUnit.ParentId, organizationUnit.TenantId);
+
         organizationUnit.Code = await GetNextChildCodeAsync(organizationUnit.ParentId);
         await ValidateOrganizationUnitAsync(organizationUnit);
         await OrganizationUnitRepository.InsertAsync(organizationUnit);
@@ -107,6 +109,8 @@ public class OrganizationUnitManager : DomainService
             return;
         }
 
+        await ValidateParentTenantAsync(parentId, organizationUnit.TenantId);
+
         //Should find children before Code change
         var children = await FindChildrenAsync(id, true);
 
@@ -148,6 +152,21 @@ public class OrganizationUnitManager : DomainService
         }
     }
 
+    protected virtual async Task ValidateParentTenantAsync(Guid? parentId, Guid? tenantId)
+    {
+        if (!parentId.HasValue)
+        {
+            return;
+        }
+
+        var parent = await OrganizationUnitRepository.FindAsync(parentId.Value);
+        if (parent == null || parent.TenantId != tenantId)
+        {
+            throw new BusinessException(IdentityErrorCodes.OrganizationUnitParentTenantMismatch)
+                .WithData("ParentId", parentId);
+        }
+    }
+
     public virtual async Task<List<OrganizationUnit>> FindChildrenAsync(Guid? parentId, bool recursive = false)
     {
         if (!recursive)

modules/identity/test/Volo.Abp.Identity.Domain.Tests/Volo/Abp/Identity/OrganizationUnitManager_Tests.cs

@@ -1,11 +1,13 @@
-using Microsoft.AspNetCore.Identity;
-using Shouldly;
-using System.Linq;
-using System.Threading.Tasks;
+using Microsoft.AspNetCore.Identity;
+using Shouldly;
+using System;
+using System.Linq;
+using System.Threading.Tasks;
 using Volo.Abp.Guids;
-using Volo.Abp.Uow;
-using Xunit;
-
+using Volo.Abp.MultiTenancy;
+using Volo.Abp.Uow;
+using Xunit;
+
 namespace Volo.Abp.Identity;
 
 public class OrganizationUnitManager_Tests : AbpIdentityDomainTestBase
@@ -17,6 +19,7 @@ public class OrganizationUnitManager_Tests : AbpIdentityDomainTestBase
     private readonly ILookupNormalizer _lookupNormalizer;
     private readonly IUnitOfWorkManager _unitOfWorkManager;
     private readonly IGuidGenerator _guidGenerator;
+    private readonly ICurrentTenant _currentTenant;
     public OrganizationUnitManager_Tests()
     {
         _organizationUnitManager = GetRequiredService<OrganizationUnitManager>();
@@ -26,6 +29,7 @@ public class OrganizationUnitManager_Tests : AbpIdentityDomainTestBase
         _testData = GetRequiredService<IdentityTestData>();
         _unitOfWorkManager = GetRequiredService<IUnitOfWorkManager>();
         _guidGenerator = GetService<IGuidGenerator>();
+        _currentTenant = GetRequiredService<ICurrentTenant>();
     }
 
     [Fact]
@@ -117,4 +121,39 @@ public class OrganizationUnitManager_Tests : AbpIdentityDomainTestBase
         ou = await _organizationUnitRepository.GetAsync("OU1", includeDetails: true);
         ou.Roles.FirstOrDefault(r => r.RoleId == adminRole.Id).ShouldBeNull();
     }
-}
+
+    [Fact]
+    public async Task Should_Not_Create_Organization_Unit_With_Cross_Tenant_Parent()
+    {
+        var hostOu = await _organizationUnitRepository.GetAsync("OU1");
+
+        using (_currentTenant.Change(Guid.NewGuid()))
+        {
+            var newOu = new OrganizationUnit(_guidGenerator.Create(), "Cross", hostOu.Id, _currentTenant.Id);
+
+            var ex = await Assert.ThrowsAsync<BusinessException>(
+                async () => await _organizationUnitManager.CreateAsync(newOu));
+
+            ex.Code.ShouldBe(IdentityErrorCodes.OrganizationUnitParentTenantMismatch);
+        }
+    }
+
+    [Fact]
+    public async Task Should_Not_Move_Organization_Unit_To_Cross_Tenant_Parent()
+    {
+        var hostOu1 = await _organizationUnitRepository.GetAsync("OU1");
+
+        OrganizationUnit tenantOu;
+        var tenantId = Guid.NewGuid();
+        using (_currentTenant.Change(tenantId))
+        {
+            tenantOu = new OrganizationUnit(_guidGenerator.Create(), "TenantRoot", null, tenantId);
+            await _organizationUnitManager.CreateAsync(tenantOu);
+
+            var ex = await Assert.ThrowsAsync<BusinessException>(
+                async () => await _organizationUnitManager.MoveAsync(tenantOu.Id, hostOu1.Id));
+
+            ex.Code.ShouldBe(IdentityErrorCodes.OrganizationUnitParentTenantMismatch);
+        }
+    }
+}