如何配置 ASP.NET MVC Core 6 Web 应用程序以使用两个不同的 Azure AD 租户作为身份验证机构？

Question

I have an ASP.NET MVC Core 6 web app that is hosted on an on-premises server. We have two different Azure tenants. It is straightforward enough to add authentication to a single tenant to allow users to login to the web app. I have a new requirement to allow users from another tenant to also login to the app. How can I add in two Azure AD authorities?

I have seen some samples on how to add multiple authentication authorities, but they are always different ones (login with Azure and login with Google, for example) and not two Azure.

Answer 1

you need to add two AddOpenIDConnect handlers, give them different names

.AddOpenIdConnect("oidc1", options => { });
.AddOpenIdConnect("oidc2", options => { });

Then give each one different callback paths, like:

options.CallbackPath = "/signin-oidc1";
options.CallbackPath = "/signin-oidc2";

and as well

SignedOutCallbackPath = "/signout-callback-oidc1";
SignedOutCallbackPath = "/signout-callback-oidc2";

That is a good starting point. Then you use one of the following to choose how the user should authenticate.

HttpContext.ChallengeAsync("oidc1");
HttpContext.ChallengeAsync("oidc2");