azure-active-directoryazure-ad-b2casp.net-core-identityasp.net-core-security

Dynamic OpenIdConnectOptions for multi-tenancy in Asp.net Core 2.1-*


I am working with aspnetcore v2.1 (latest dev branches) in order to create a multi-tenant app where each tenant authenticates against their own Azure B2C AD tenant. This aproach was chosen so that email/password selections and social login associations are unique per-tenant.

Instead of a static ClientId applied in Startup.ConfigureServices, I want to apply the correct ClientId and Authority based on the current tenant identity (which I determine based on the hostname). Based on previous inspection of the 2.0-* code, I had been using an IOptionsSnapshot to allow me to apply the correct options as shown below.

In Startup.ConfigureServices:

services.AddSingleton<IOptionsSnapshot<OpenIdConnectOptions>, OpenIdConnectOptionsSnapshot>();
services.AddAuthentication().AddCookie().AddOpenIdConnect();

In Startup.Configure:

app.UseAuthentication();

With an implementation of :

public class OpenIdConnectOptionsSnapshot : IOptionsSnapshot<OpenIdConnectOptions>

However, now I find that my OpenIdConnectOptionsSnapshot is no longer being instantiated or referenced.

What is the correct way to apply a dynamic per-tenant ClientId, Authority, etc under AspNetCore Security 2.1.0-*?

(I am open to "you're doing it completely wrong" and suggestions of different ways to achieve multi-tenancy for tenants that have no pre-existing AzureAD footprint)


Solution

  • Try using IOptionsMonitor instead, we changed how IOptionsSnapshot worked fairly late in 2.0 and switched auth over to use the monitor instead.

    OptionsSnapshot is now scoped