Multi-Tenant with AspNetCore.Identity

[ovidiaconescu]

Is there a preferred way to enable multi-tenancy on IDS4 on aspnetcore 2.0 using AspNetCore.Identity?

The samples from #442 - https://github.com/schatekar/IdentityServer4.MultiTenant and https://github.com/khelben/IdsvrMultiTenantExample based on https://github.com/saaskit/saaskit no longer work due to the fact that the method UseCookieAuthentication in CookieAppBuilderExtensions is now obsolete.

I've attempted to work it out like https://stackoverflow.com/questions/48384484/multitentant-identity-server-4#comment85163360_48384484 and modify the AspNetUser and SignInManager as in https://www.scottbrady91.com/ASPNET-Identity/Quick-and-Easy-ASPNET-Identity-Multitenancy but the issue stands that signing-in a user on one tentant automatically considers it signed-in on all clients.

[ovidiaconescu]

Since the problem is with builder.UseCookieAuthentication, as it is now obsolete, I've done a PR on saaskit to update it to netcoreapp2.0 and changed the way auth is set in the AspNetMvcAuthDemo

I'm using two transient services that set the configuration from the tenant every time it is needed.
This is something that @brockallen suggested way back in #19

See PR here: saaskit/saaskit#96

[leastprivilege]

Any update on the issue? closing for now - feel free to re-open if it needs further discussion.

[ovidiaconescu]

Not unless there is another suggested way to achieve multi-tenancy?

[leastprivilege]

ASP.NET Core itself is not multi-tenant. So regardless how much duct-tape you put around it - there are limits.

[AndrewTriesToCode]

@ovidiaconescu Apologies in advance for commenting on a closed item--I have found a decent solution for multitenancy and authentication under the new ASP.NET Core 2 model. It centers around customizing IOptionsCache and the end result is custom Cookie or OpenID Connect (or really any authentication options) per tenant.

I have some code that wraps up this approach nicely including support for tenant identification by subdomain or route variable. See the "Finbuckle.MultiTenant" project on my profile if you are interested in seeing how I was able to get this to work. There is a sample project in there that does exactly what I think you are looking for.

[maxisam]

@leastprivilege your statement might not be true after 2.1.

aspnet/Security#1718

https://stackoverflow.com/questions/49596938/openid-connect-identifying-tenant-during-login/49682427#49682427

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.