Mixed Authentication in .net core API

Question

I'm building a multi tenant Service Fabric Application, that allows a tenant to specify a login type - Identity(asp.net)/Azure AD.

I have an Authentication service that checks to which tenant the user is linked to and then proceeds to check if the username:password for the user is valid, if valid it returns a JWT token to the gateway API/web API that then allows access to the rest of the services on the cluster.

This is further secured by roles to limit actions and data access etc.

Question 1 What would be a secure way to save the app id and secret given by that tenant if they use azure AD? In my DB and encrypt the info, it would have to be decrypted to connect to the AD(Trying to keep in dynamic).

Question 2 I'm implementing my own sliding refresh tokens to obtain a new JWT after it expires, is there a better/standard approach?

Question 3 Is there a better/standard way to handle this multi-tenant sign in process.

Question 4 Is there a way to have optional claims set on the JWT Subject that would allow access to shared services but prevent access to tenant specific services if the claim value is incorrect?

Edit Ideally the Roles should not be part of the tenants AD/B2C because they role are dynamic and managed from within the application.

user_5946937 · Answer

Instead of building your own STS logic, have a look at IdentityServer, a popular and great OSS tool.

For example, have a look here for a multi-tenant example using asp.net core.

It supports adding custom claims to the token, by implementing a Profile Service. Services can be configured to use claims for authorization.

This blog post may also be useful.

user_132639 · Answer

I will very strongly advise you ride upon the Azure tenant model and let Azure AD manage all credentials and authentication. In today's world its a very bad idea to store and manage user credentials when there are plenty of Identity Providers available.

Mixed Authentication in .net core API

2 Answers