Looking for some assistance with OIDC Multitenant partially working

[AaronPatsfan]

Really excited to get this working so i can use finbuckle in some other projects, but I ran into an issue with oidc logins which i'm sure is a misconfiguration on my end somewhere. I have okta working, but when i added entra, i get the following error:
fail: Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler[17]
Exception occurred while processing message.
Microsoft.IdentityModel.Tokens.SecurityTokenSignatureKeyNotFoundException: IDX10503: Signature validation failed. The token's kid is: 'XXXXX', but did not match any keys in TokenValidationParameters or Configuration. Keys tried: 'Microsoft.IdentityModel.Tokens.X509SecurityKey, KeyId: 'XXXXX', InternalId: 'XXXXX'. , KeyId: wh06sEkzLHJ5sNNaUyRY2_6O8K0
Microsoft.IdentityModel.Tokens.RsaSecurityKey, KeyId: 'XXXXX', InternalId: 'XXXX'. , KeyId: XXXXX
Microsoft.IdentityModel.Tokens.X509SecurityKey, KeyId: 'XXXXX', InternalId: 'k2MRQ8fu3BbJrTPLnDOyWDq1m60'. , KeyId: XXXX
Microsoft.IdentityModel.Tokens.RsaSecurityKey, KeyId: 'XXXXX', InternalId: 'TG0sMUhLFy3r0RWvSkBRnQJFiohQtABeVm5f51XyNRE'. , KeyId: XXXXX
Microsoft.IdentityModel.Tokens.X509SecurityKey, KeyId: 'XXXXX, InternalId: 'XXXXX'. , KeyId: XXXXX
Microsoft.IdentityModel.Tokens.RsaSecurityKey, KeyId: 'XXXXX', InternalId: 'XXXXX'. , KeyId: XXXXX
Microsoft.IdentityModel.Tokens.X509SecurityKey, KeyId: 'XXXXX', InternalId: 'XXXXX. , KeyId: XXXXX
Microsoft.IdentityModel.Tokens.RsaSecurityKey, KeyId: 'XXXXX, InternalId: 'XXXXX'. , KeyId: XXXXX
Microsoft.IdentityModel.Tokens.X509SecurityKey, KeyId: 'IXXXXX', InternalId: 'XXXXX. , KeyId: IAwWqyVsYi4K2fULSN3n6aezXmU
Microsoft.IdentityModel.Tokens.RsaSecurityKey, KeyId: 'XXXXX', InternalId: 'XXXXX'. , KeyId: XXXXX
'. Number of keys in TokenValidationParameters: '0'.
Number of keys in Configuration: '10'.

Here's my configuration with code I needed to add to get the redirection urls to be generated using https instead of http while running in a docker container. If that https issue can be dealt with more elegantly please let me know. Other than that
using System.Diagnostics;

using Finbuckle.MultiTenant.AspNetCore.Extensions;
using Finbuckle.MultiTenant.EntityFrameworkCore.Extensions;
using Finbuckle.MultiTenant.Extensions;
using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Authentication.OpenIdConnect;
using Microsoft.AspNetCore.HttpLogging;
using Microsoft.AspNetCore.HttpOverrides;
using Microsoft.EntityFrameworkCore;
using virtuescript.sso;

var builder = WebApplication.CreateBuilder(args);
builder.Logging.ClearProviders();
builder.Logging.AddConsole();

// Adds request/response logging to console for troubleshooting auth redirects.
builder.Services.AddHttpLogging(options =>
{
options.LoggingFields = HttpLoggingFields.RequestMethod |
HttpLoggingFields.RequestPath |
HttpLoggingFields.ResponseStatusCode |
HttpLoggingFields.RequestHeaders;
options.RequestHeaders.Add("X-Forwarded-Proto");
options.RequestHeaders.Add("X-Forwarded-Host");
});

builder.WebHost.ConfigureKestrel(options =>
{
options.ListenAnyIP(5101);
if (Debugger.IsAttached)
{
options.ListenLocalhost(5100, listenOptions =>
{
listenOptions.UseHttps(); // HTTPS
});
}
});
// ── MVC ──────────────────────────────────────────────────────────────────────
builder.Services.AddControllersWithViews();

builder.Services.Configure(options =>
{
options.ForwardedHeaders =
ForwardedHeaders.XForwardedFor |
ForwardedHeaders.XForwardedProto |
ForwardedHeaders.XForwardedHost;

// Trust forwarded headers from the ingress/reverse proxy.
// Prefer explicit KnownProxies/KnownIPNetworks in hardened production setups.
options.KnownIPNetworks.Clear();
options.KnownProxies.Clear();

});

// ── EF Core: Tenant Store DB ──────────────────────────────────────────────────
// This database holds the registry of all tenants and their Okta OIDC settings.
builder.Services.AddDbContext(options =>
options.UseSqlServer(builder.Configuration.GetConnectionString("Default")));

// ── Authentication ────────────────────────────────────────────────────────────
// Register Cookie + OpenIdConnect base schemes.
// WithPerTenantAuthentication() will override OIDC options per-tenant at runtime.
builder.Services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
.AddCookie()
.AddOpenIdConnect(OpenIdConnectDefaults.AuthenticationScheme, options =>
{
// Fallback/default OIDC options. Per-tenant values from AppTenantInfo
// (OpenIdConnectAuthority, OpenIdConnectClientId, OpenIdConnectClientSecret)
// override these automatically via WithPerTenantAuthentication().
options.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
options.ResponseType = "code";
options.SaveTokens = true;
options.GetClaimsFromUserInfoEndpoint = true;
options.Scope.Add("openid");
options.Scope.Add("profile");
options.Scope.Add("email");

    // Placeholder values so ASP.NET Core options validation passes when
    // RemoteAuthenticationCallbackStrategy reads OIDC options before a
    // tenant is resolved. Per-tenant values override these at runtime.
    options.ClientId = "placeholder";
    options.Authority = "https://placeholder.invalid";
});

// ── Finbuckle MultiTenant ─────────────────────────────────────────────────────
builder.Services.AddMultiTenant()
// Resolve the tenant from the {tenant} route parameter.
// e.g., /acme/home → tenant identifier = "acme"
.WithRouteStrategy()
// Load tenant configurations from the EF Core store (TenantStoreDbContext).
.WithEFCoreStore<TenantStoreDbContext, AppTenantInfo>()
// Wire up per-tenant OIDC using convention-mapped AppTenantInfo properties:
// OpenIdConnectAuthority, OpenIdConnectClientId, OpenIdConnectClientSecret,
// ChallengeScheme, CookieLoginPath, CookieLogoutPath, CookieAccessDeniedPath
.WithPerTenantAuthentication();

// ── Per-Tenant OIDC Callback Path ─────────────────────────────────────────────
// The route strategy uses /{tenant}/... so the OIDC callback path must include
// the tenant identifier. This lets Finbuckle resolve the tenant during the Okta
// redirect, set the auth cookie, and return the user to the right tenant path.
// Register https://localhost:5100/{tenant}/signin-oidc as the redirect URI in Okta.
builder.Services.ConfigurePerTenant<OpenIdConnectOptions, AppTenantInfo>(
OpenIdConnectDefaults.AuthenticationScheme, (options, tenantInfo) =>
{
options.CallbackPath = $"/{tenantInfo.Identifier}/home/oidcsignin";
options.SignedOutCallbackPath = $"/{tenantInfo.Identifier}/home/oidcsignout";

    // Force HTTPS in redirect_uri sent to OIDC provider, regardless of local request scheme.
    // If you're debugging you should use port 5101 instead of 5100 so your host will respond, unless you're testing http url generation.
    options.Events.OnRedirectToIdentityProvider = context =>
    {
        if (context.ProtocolMessage.RedirectUri != null)
        {
            var uri = new Uri(context.ProtocolMessage.RedirectUri);
            if (uri.Scheme == "http")
            {
                context.ProtocolMessage.RedirectUri = uri.Scheme switch
                {
                    "http" => new Uri(uri.AbsoluteUri.Replace("http://", "https://")).AbsoluteUri,
                    _ => context.ProtocolMessage.RedirectUri
                };
            }
        }
        return Task.CompletedTask;
    };
});

builder.Services.AddSingleton();
builder.Services.Configure(builder.Configuration.GetSection("RemoteApiConfig"));
builder.Services.AddScoped();
builder.Services.AddScoped();

// ── Build ─────────────────────────────────────────────────────────────────────
var app = builder.Build();
app.Logger.LogInformation("Starting SSO host. Environment: {EnvironmentName}", app.Environment.EnvironmentName);

// Apply EF migrations and seed tenants on startup (development only).
if (app.Environment.IsDevelopment())
{
using var scope = app.Services.CreateScope();
var db = scope.ServiceProvider.GetRequiredService();
db.Database.Migrate();
}

// ── Middleware pipeline ───────────────────────────────────────────────────────
if (!app.Environment.IsDevelopment())
{
app.UseExceptionHandler("/Home/Error");
app.UseHsts();
}

app.UseForwardedHeaders();
app.UseHttpLogging();

app.UseHttpsRedirection();
// UseRouting must come before UseMultiTenant when using the route strategy.
app.UseRouting();

// Resolve the tenant from the route before authentication middleware runs.
app.UseMultiTenant();

app.UseAuthentication();
app.UseAuthorization();

app.MapStaticAssets();

// The {tenant} segment is the first path component and is used by
// Finbuckle's route strategy to identify the current tenant.
// Example: /acme/home/index → tenant=acme, controller=Home, action=Index
app.MapControllerRoute(
name: "default",
pattern: "{tenant}/{controller=Home}/{action=Index}/{id?}")
.WithStaticAssets();

app.Run();

[AndrewTriesToCode]

Hi @AaronPatsfan

I’ll take a look. Just as a reality check can you confirm the issue doesn’t occur in a non multitenant app?

[AaronPatsfan]

Ya, I can connect to entra and get the credentials to work just fine, adding a second using oidc doesn't work. I've added a default challenge schema to the startup and will test using that. My suspicion is my understanding of how finbuckle matched the tenant to the challenge data wasn't complete.
Copilots resolution would be to register schemes for each provider like so:
builder.Services.AddAuthentication(options =>
{
options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
})
.AddCookie()

// ── Okta ─────────────────────────────
.AddOpenIdConnect("oidc-okta", options =>
{
options.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
options.ResponseType = "code";

options.ClientId = "placeholder";
options.Authority = "https://placeholder.okta.com";

})

// ── Entra ────────────────────────────
.AddOpenIdConnect("oidc-entra", options =>
{
options.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
options.ResponseType = "code";

options.ClientId = "placeholder";
options.Authority = "https://login.microsoftonline.com/common/v2.0";

});

I'm just not sure how that would make a difference when the authority comes from the tenant database anyway.

[AaronPatsfan]

Separating them out actually seems to break everying, so no dice there.

[AndrewTriesToCode]

Hi, this comment is misleading:

// The route strategy uses /{tenant}/... so the OIDC callback path must include
// the tenant identifier. This lets Finbuckle resolve the tenant during the Okta
// redirect, set the auth cookie, and return the user to the right tenant path.

This is not needed--try removing the custom callback paths per tenant. The per-tenant auth logic will set and retrieve the tenant by including it in the state parameter passed to the OIDC server and interpret it within the UseMultiTenant middlware. This also means you don't have to register a bunch of different callback urls to each identity provider.

Let me know if that helps.

[AaronPatsfan]

Specifically you mean these two lines?
options.CallbackPath = $"/{tenantInfo.Identifier}/home/oidcsignin";
options.SignedOutCallbackPath = $"/{tenantInfo.Identifier}/home/oidcsignout";
If you mean the whole method, is there a better way you could recommend to get the auth middleware to always use https when hosted in a container with external tls termination?

[AndrewTriesToCode]

Yep, just those two lines

[AaronPatsfan]

Removing those 2 lines resulted in my callback urls being generated without the tenant identifier like so:
&redirect_uri=https%3A%2F%2Flocalhost%3A5100%2Fsignin-oidc&
I'm using version 10.1.1 with asp.net 10.0.9
My tenantinfo scheme is:
[Id]
,[Identifier]
,[Name]
,[CookieLoginPath]
,[CookieLogoutPath]
,[CookieAccessDeniedPath]
,[ChallengeScheme]
,[OpenIdConnectAuthority]
,[OpenIdConnectClientId]
,[OpenIdConnectClientSecret]
FROM [dbo].[TenantInfo]

[AaronPatsfan]

After doing so this still worked for my okta tenant after adjusting the callback url, entra still fails. Just FYI, what happens is after the authentication in the index it creates a signin token for our main site then redirects to that site. The entra tenant still has the state issue with a 405 response. Here is additional debug logging for an entra tenant request:
dbug: Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets[6]
Connection id "[ConnectionId]" received FIN.
dbug: Microsoft.AspNetCore.Server.Kestrel.Http2[48]
Connection id "[ConnectionId]" is closed.
dbug: Microsoft.AspNetCore.Server.Kestrel.Connections[39]
Connection id "[ConnectionId]" accepted.

info: Microsoft.AspNetCore.Hosting.Diagnostics[1]
Request starting HTTP/2 GET https://localhost:[Port]/[tenant]/ - - -

info: Microsoft.AspNetCore.HttpLogging.HttpLoggingMiddleware[1]
Request:
Protocol: HTTP/2
Method: GET
Scheme: https
Path: /[tenant]/
Host: localhost:[Port]
User-Agent: [Browser Info]
Headers: [Redacted]

dbug: Finbuckle.MultiTenant.AspNetCore.Strategies.RouteStrategy[0]
GetIdentifierAsync: Found identifier: "entradev"

dbug: Microsoft.EntityFrameworkCore.Database.Connection[20000]
Opening connection to database '[DatabaseName]' on server '[DatabaseServer]'.

dbug: Microsoft.EntityFrameworkCore.Database.Command[20100]
Executing DbCommand:
SELECT TOP(2) ...
FROM [TenantInfo]
WHERE [Identifier] = @Identifier

info: Microsoft.EntityFrameworkCore.Database.Command[20101]
Executed DbCommand

dbug: Finbuckle.MultiTenant.EntityFrameworkCore.Stores.EFCoreStore[0]
GetByIdentifierAsync: Tenant found with identifier "entradev"

info: OIDC.Diagnostics[0]
OIDC Challenge → Authority: https://login.microsoftonline.com/[TenantId]/v2.0
ClientId: [ClientId]
redirect_uri: https://localhost:[Port]/signin-oidc

info: Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler[12]
AuthenticationScheme: OpenIdConnect was challenged.

info: Microsoft.AspNetCore.HttpLogging.HttpLoggingMiddleware[2]
Response:
StatusCode: 302
Location: https://login.microsoftonline.com/[TenantId]/oauth2/v2.0/authorize?...&client_id=[ClientId]&...
Set-Cookie: [Redacted]

---

info: Microsoft.AspNetCore.Hosting.Diagnostics[1]
Request starting HTTP/2 POST https://localhost:[Port]/signin-oidc

info: Microsoft.AspNetCore.HttpLogging.HttpLoggingMiddleware[1]
Request:
Protocol: HTTP/2
Method: POST
Path: /signin-oidc
Headers:
Cookie: [Redacted]
Origin: [Redacted]
Referer: [Redacted]
Content-Length: [Redacted]

dbug: Finbuckle.MultiTenant.AspNetCore.Strategies.RouteStrategy[0]
GetIdentifierAsync: Found identifier: "signin-oidc"

dbug: Finbuckle.MultiTenant.EntityFrameworkCore.Stores.EFCoreStore[0]
GetByIdentifierAsync: Unable to find Tenant with identifier "signin-oidc"

dbug: Finbuckle.MultiTenant.AspNetCore.Strategies.RemoteAuthenticationCallbackStrategy[0]
GetIdentifierAsync: Found identifier: "entradev"

info: OIDC.Diagnostics[0]
OIDC Callback inbound | Path: /signin-oidc | HasStateParam: False | CorrelationCookie: True | NonceCookie: True

trce: Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler[27]
Authorization code received. (code redacted)

dbug: Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler[19]
Redeeming code for tokens.

fail: Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler[17]
Exception occurred while processing message.

  Microsoft.IdentityModel.Tokens.SecurityTokenSignatureKeyNotFoundException:
  IDX10503: Signature validation failed. The token's kid did not match any keys in configuration.

info: Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler[4]
Error from RemoteAuthentication: IDX10503 Signature validation failed.

fail: OIDC.Diagnostics[0]
OIDC Remote Failure: IDX10503 - Signature validation failed.

info: Microsoft.AspNetCore.HttpLogging.HttpLoggingMiddleware[2]
Response:
StatusCode: 200
Set-Cookie: [Redacted]

info: Microsoft.AspNetCore.Routing.EndpointMiddleware[1]
Executed endpoint '405 HTTP Method Not Supported'

info: virtuescript-sso[0]
Request for tenant (no-tenant): /Home/Error -> 405

fail: Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddleware[1]
An unhandled exception has occurred:
Microsoft.AspNetCore.Authentication.AuthenticationFailureException:
Error while handling remote login.
---> SecurityTokenSignatureKeyNotFoundException: IDX10503 Signature validation failed.

info: Microsoft.AspNetCore.Hosting.Diagnostics[2]
Request finished HTTP/2 POST https://localhost:[Port]/signin-oidc - 405

[AaronPatsfan]

I managed to get this fixed, there were a couple of contributing factors, i think the only one that concerned finbuckle was token refresh requests were routed to oidc-signin which was throwing the exception regarding the post method.

[AndrewTriesToCode]

Excellent! Happy coding!