.NET Core Multi Tenancy authentication
I have an application hosted in Azure (Tenant A).
I also have tenant B in Azure. There are users split in either tenant A or tenant B (Azure Active Directory) that requires login to this application.
If the user is logging in with "name@tenantA.com", then it should automatically authenticate against tenant A and if a user with "name@tenantB.com" is logging in then should be authenticated with tenant B.
I have tried logging in via single tenant and that works.
What do I need to setup to allow for this to happen?
Azure AD multi-tenant mechanism is designed for the scenario you describe. Since you can work well in single tenant, I trust you already know how to create an Azure AD application. And please make sure the application you created is multi-tenant type. If not, you might need to create a new one for test.
Then to make users from different tenants to sign into your application, we need to make sure the sign url is common rather than the tenant id. Let's assume you are working on an asp.net core MVC application. Then we might have configurations below in your appsettings.json. Make sure the tenant id is set to common.
"AzureAd": {
"Instance": "https://login.microsoftonline.com/",
"Domain": "tenant id of the tenant where the AAD app registered",
"TenantId": "common",//make sure it's common
"ClientId": "client id of the AAD app",
"CallbackPath": "/signin-oidc",
"ClientSecret": "client_secret"
},
Then we will see the sign in url looks like this
And users from tenant B could sign in this application using name@tenantB.com. Pls note that the first time users from tenant B sign in the app, they will see a consent window which asking them to consent some API permissions. This is based on the API permissions you added to the Azure AD application. If some of the permissions requires tenant admin consent, then admin of tenantB shall grant consent before normal users sign in. Admin consent url https://login.microsoftonline.com/{tenantB-id}/adminconsent?client_id={your-client-id}.
- Replace a dropdownlist by a combobox (editable dropdown)
- How to fix 500.30 - ASP.NET CORE app failed to start
- How can I programmatically determine the Blazor render mode
- How do I integration test a SoapCore endpoint?
- How to add an environment indicator into a razor page?
- Implement dotnet core Identity Provider server for Google
- ASP.Net Core API failing when I try to return results from Active Directory search and some values are empty
- View is not found when a Web App is deployed with Azure DevOps
- Set Log Levels for Microsoft.* , System, and AspNet when using Serilog
- tsconfig.json: Build:No inputs were found in config file
- Docker: No frameworks and runtimes were found (.NET 8)
- Logging in ASP.NET Core Main
- System.Net.Http vs Microsoft.Net.Http
- Get caller info for injected service in .NET Core
- LINQ Query Translation Error with Array of Search Queries in EF Core
- Cannot export file on .NET Core application
- Using ASP.Net Core Identity for Razor page web app and MAUI app
- Store does not implement IUserRoleStore<TUser> ASP.NET Core Identity
- Applying EF Core Global Filter to a collection of tenants instead of a single TenantId
- Usehealthchecks vs Maphealthchecks
- How to resolve "TypeError: Failed to fetch" error on Blazor?
- @Html.Action in Asp.Net Core
- Why does ASP.NET Core 9 strip out importmap?
- Exclude specific endpoint serilog logging using aspnet core
- Why use AddScoped() instead of AddSingleton()?
- Blazor requesting a json file
- ASP.NET Core clear cache from IMemoryCache (set by Set method of CacheExtensions class)
- EF Core multitenacy, different schema. EF Core does not change the table schema when the API is at runtime
- NLOG Database Target can't connect
- Entity Framework Core: `SqlNullValueException: Data is Null.` How to troubleshoot?