asp.net-coreauthenticationazure-active-directorymulti-tenant

.NET Core Multi Tenancy authentication

I have an application hosted in Azure (Tenant A).

I also have tenant B in Azure. There are users split in either tenant A or tenant B (Azure Active Directory) that requires login to this application.

If the user is logging in with "name@tenantA.com", then it should automatically authenticate against tenant A and if a user with "name@tenantB.com" is logging in then should be authenticated with tenant B.

I have tried logging in via single tenant and that works.

What do I need to setup to allow for this to happen?

Solution

  • Azure AD multi-tenant mechanism is designed for the scenario you describe. Since you can work well in single tenant, I trust you already know how to create an Azure AD application. And please make sure the application you created is multi-tenant type. If not, you might need to create a new one for test.

    enter image description here

    Then to make users from different tenants to sign into your application, we need to make sure the sign url is common rather than the tenant id. Let's assume you are working on an asp.net core MVC application. Then we might have configurations below in your appsettings.json. Make sure the tenant id is set to common.

    "AzureAd": {
   "Instance": "https://login.microsoftonline.com/",
   "Domain": "tenant id of the tenant where the AAD app registered",
   "TenantId": "common",//make sure it's common
   "ClientId": "client id of the AAD app",
   "CallbackPath": "/signin-oidc",
   "ClientSecret": "client_secret"
 },

    Then we will see the sign in url looks like this

    enter image description here

    And users from tenant B could sign in this application using name@tenantB.com. Pls note that the first time users from tenant B sign in the app, they will see a consent window which asking them to consent some API permissions. This is based on the API permissions you added to the Azure AD application. If some of the permissions requires tenant admin consent, then admin of tenantB shall grant consent before normal users sign in. Admin consent url https://login.microsoftonline.com/{tenantB-id}/adminconsent?client_id={your-client-id}.