Add tenant claim to access token using IdentityServer 4 based on acr value

Since you want the user to login for each tenant (bypassing sso) makes this solution possible.

When logging in, you can add a claim to the local user (IdentityServer) where you store the tenant name:

public async Task<IActionResult> Login(LoginViewModel model, string button)
{

    // take returnUrl from the query
    var context = await _interaction.GetAuthorizationContextAsync(returnUrl);
    if (context?.ClientId != null)
    {
        // acr value Tenant
        if (context.Tenant == null)
            await HttpContext.SignInAsync(user.Id, user.UserName);
        else
            await HttpContext.SignInAsync(user.Id, user.UserName, new Claim("tenant", context.Tenant));

When the ProfileService is called you can use the claim and pass it to the access token:

public async Task GetProfileDataAsync(ProfileDataRequestContext context)
{

    // Only add the claim to the access token
    if (context.Caller == "ClaimsProviderAccessToken")
    {
        var tenant = context.Subject.FindFirstValue("tenant");
        if (tenant != null)
            claims.Add(new Claim("tenant", tenant));
    }

The claim is now available in the client.

Problem is, that with single sign-on the local user is assigned to the last used tenant. So you need to make sure the user has to login again, ignoring and overwriting the cookie on IdentityServer.

This is the responsibility from the client, so you can set prompt=login to force a login. But originating from the client you may want to make this the responsibility of the server. In that case you may need to override the interaction response generator.

However, it would make sense to do something like this when you want to add tenant specific claims. But it seems you are only interested in making a distinction between tenants.

In that case I wouldn't use above implementation but move from perspective. I think there's an easier solution where you can keep the ability of SSO.

What if the tenant identifies itself at the resource? IdentityServer is a token provider, so why not create a custom token that contains the information of the tenant. Use extension grants to create an access token that combines tenant and user and restricts access to that combination only.

To provide some code for others who want to use the extension grant validator as one suggested option by the accepted answer. Take care, the code is quick and dirty and must be properly reviewed. Here is a similar stackoverflow answer with extension grant validator.

IExtensionGrantValidator

using IdentityServer4.Models;
using IdentityServer4.Validation;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Security.Claims;
using System.Threading.Tasks;

namespace IdentityService.Logic {
  public class TenantExtensionGrantValidator : IExtensionGrantValidator {
    public string GrantType => "Tenant";

    private readonly ITokenValidator _validator;

    private readonly MyUserManager _userManager;

    public TenantExtensionGrantValidator(ITokenValidator validator, MyUserManager userManager) {
      _validator = validator;
      _userManager = userManager;
    }

    public async Task ValidateAsync(ExtensionGrantValidationContext context) {
      String userToken = context.Request.Raw.Get("AccessToken");
      String tenantIdRequested = context.Request.Raw.Get("TenantIdRequested");

      if (String.IsNullOrEmpty(userToken)) {
        context.Result = new GrantValidationResult(TokenRequestErrors.InvalidGrant);
        return;
      }
      var result = await _validator.ValidateAccessTokenAsync(userToken).ConfigureAwait(false);
      if (result.IsError) {
        context.Result = new GrantValidationResult(TokenRequestErrors.InvalidGrant);
        return;
      }

      if (Guid.TryParse(tenantIdRequested, out Guid tenantId)) {
        var sub = result.Claims.FirstOrDefault(c => c.Type == "sub")?.Value;
        var claims = result.Claims.ToList();
        claims.RemoveAll(x => x.Type == "tenantid");
        IEnumerable<Guid> tenantIdsAvailable = await _userManager.GetTenantIds(Guid.Parse(sub)).ConfigureAwait(false);
        if (tenantIdsAvailable.Contains(tenantId)) {
          claims.Add(new Claim("tenantid", tenantId.ToString()));
          var identity = new ClaimsIdentity(claims);
          var principal = new ClaimsPrincipal(identity);
          context.Result = new GrantValidationResult(principal);
          return;
        }
      }
      context.Result = new GrantValidationResult(TokenRequestErrors.InvalidGrant);
    }
  }
}

Client config

        new Client {
                    ClientId = "tenant.client",
                    ClientSecrets = { new Secret("xxx".Sha256()) },
                    AllowedGrantTypes = new [] { "Tenant" },
                    RequireConsent = false,
                    RequirePkce = true,
                    AccessTokenType = AccessTokenType.Jwt,
                    AllowOfflineAccess = true,
                    AllowedScopes = new List<String> {
                        IdentityServerConstants.StandardScopes.OpenId,
                    },
                },

Token exchange in client

I made a razor page which receives as url parameter the requested tenant id, because my test app is a blazor server side app and i had problems to do a sign in with the new token (via _userStore.StoreTokenAsync). Note that i am using IdentityModel.AspNetCore to manage token refresh. Thats why i am using the IUserTokenStore. Otherwise you would have to do httpcontext.signinasync as Here.

public class TenantSpecificAccessTokenModel : PageModel {

    private readonly IUserTokenStore _userTokenStore;

    public TenantSpecificAccessTokenModel(IUserTokenStore userTokenStore) {
      _userTokenStore = userTokenStore;
    }

    public async Task OnGetAsync() {
      Guid tenantId = Guid.Parse(HttpContext.Request.Query["tenantid"]);
      await DoSignInForTenant(tenantId);
    }

    public async Task DoSignInForTenant(Guid tenantId) {
      HttpClient client = new HttpClient();
      Dictionary<String, String> parameters = new Dictionary<string, string>();
      parameters.Add("AccessToken", await HttpContext.GetUserAccessTokenAsync());
      parameters.Add("TenantIdRequested", tenantId.ToString());
      TokenRequest tokenRequest = new TokenRequest() {
        Address = IdentityProviderConfiguration.Authority + "connect/token",
        ClientId = "tenant.client",
        ClientSecret = "xxx",
        GrantType = "Tenant",
        Parameters = parameters
      };
      TokenResponse tokenResponse = await client.RequestTokenAsync(tokenRequest).ConfigureAwait(false);
      if (!tokenResponse.IsError) {
        await _userTokenStore.StoreTokenAsync(HttpContext.User, tokenResponse.AccessToken, tokenResponse.ExpiresIn, tokenResponse.RefreshToken);
        Response.Redirect(Url.Content("~/").ToString());
      }
    }
  }