在ASP.NET CORE中添加多个B2C认证

Question

I have a project in ASP.NET CORE 3.1 using B2C authentification. I have configure the authentification's configuration like this:

 services.AddAuthentication(AzureADB2CDefaults.AuthenticationScheme)
                .AddAzureADB2C(options => Configuration.Bind("A", options));

Where "A" is my json with my B2C's informations like client id, tenant id etc...

the json look like this:

"A": {
    "Instance": "https://A.b2clogin.com/tfp/",
    "ClientId": "359fes9e-42a0-4c13-8693-961f6f6f0f79",
    "CallbackPath": "/signin-oidc",
    "Domain": "A.onmicrosoft.com",
    "SignUpSignInPolicyId": "B2C_1A_signup_signin"}, 
"B": {
    "Instance": "https://B.b2clogin.com/tfp/",
    "ClientId": "359fes9e-42a0-4c13-8693-96fejoff0f79",
    "CallbackPath": "/signin-oidc",
    "Domain": "A.onmicrosoft.com",
    "SignUpSignInPolicyId": "B2C_1B_signup_signin"}, 

I want to switch my B2C Authentication config (for exemple json A to json B).

Tested:

I have been tested to set two B2C in my startup.cs like this:

 services.AddAuthentication(AzureADB2CDefaults.AuthenticationScheme)
                .AddAzureADB2C(options => Configuration.Bind("A", options))
                .AddAzureADB2C(options => Configuration.Bind("B", options));

No work...

And i have been tested to set up Authentication with OpenId Connect like this:

 services.AddAuthentication()
              
               .AddOpenIdConnect("A", options => {

                   options.Authority = A.Authority;
                   options.CallbackPath = A.CallbackPath;
                   options.ClientId = A.ClientID;

                    })

               .AddOpenIdConnect("B", options => {

                   options.Authority = B.Authority;
                   options.CallbackPath = B.CallbackPath;
                   options.ClientId = B.ClientID;

                    })

And this solution not work too.

If you have a solution or documentation that his explain my problem, Thank in advance !

Corentin

Answer 1

If i understand your requirement, you need to accept tokens from multiple sign in policies. We had this same requirement as well, to solve it, we abandoned the out of the box helpers and created our own. The issue you will face using the out of the box extensions is twofold, one the underlying code does not allow multiple elements, and the other is, the signing keys will differ policy to policy. To get around that, we basically call the well-known endpoint for each policy (standard format, if you have policy name, the url is easy to build), we then grab the signing keys and insert them into an array. We use that to create the TokenValidationParameters object that is then used in the call services.AddAuthentication().AddJwtBearer call for the jwtOptions.TokenValidationParameters If you still need this answer, i can probably sanitize the code enough to share.