IdentityServer4在身份验证后添加租户声明

IdentityServer4在身份验证后添加租户声明

问题描述:

我有一个多租户方案,其中一封电子邮件可以与多个租户关联.

I have a multi-tenant scenario in which one email can be associated with multiple tenants.

因此,我已经配置了一个自定义的AccountChooserResponseGenerator,它继承自内置的AuthorizeInteractionResponseGenerator类.

I've thus configured a custom AccountChooserResponseGenerator that inherits from the built-in AuthorizeInteractionResponseGenerator class.

在用户进行身份验证之后,UI会正确地将用户转移到帐户选择器"视图,该视图列出了与电子邮件地址相关联的租户.这样的想法是,用户现在必须选择他/她要登录的租户,然后将其重定向到该租户的URI.

After the user authenticates, the UI correctly diverts the user to an Account Chooser view, which lists the tenants the email address is associated with. The idea being that the user must now select the Tenant he/she wants to log in to, and then get redirected to that Tenant's URI.

我的问题是,我无法弄清楚选择租户后如何将该租户ID作为声明添加到从IdentityServer传递到应用程序的令牌中(多个租户可以共享相同的URL,因此我需要令牌中的内容来了解​​哪个租户具有上下文).

My problem though is that I can't figure out how, after selecting a Tenant, I can add that Tenant Id as a Claim to the token that gets passed to the app from IdentityServer (multiple tenants could share the same URL so I need something in the token to know which Tenant has context).

因此,在AccountChooserController.TenantSelected(long tenantId)方法中,我希望能够将此tenantId添加到用户声明中,但似乎不支持此功能.

So in the AccountChooserController.TenantSelected(long tenantId) method, I'm expecting to be able to add this tenantId to the User Claims, but it does not seem like this is supported.

请告知这是否可行以及如何?

Please advise if this is possible, and how?

调用SignInAsync时,将租户信息放入cookie中-然后您可以从个人资料服务中检索它.

Put the tenant information into the cookie when calling SignInAsync - you can then retrieve it from your profile service.