Multi-Tenant Authentication Using Azure AD In ASP.NET

One additional thing you need to take care is you need to enable multi-tenant flip switch option to Yes for the application which you have added in Azure Active directory.

Also now as per the concept of multi-tenant authentication we want user of any other tenant to access the application registered in some other tenant, for that we need to add user of one directory into other directory in which the application is registered.

As shown in the below image I have added User (myad2user) of

Directory2 (ad2) in Directory1 (ad1).

Let’s create a simple ASP.Net application since we will be implementing a multi-tenant authentication on that uses Azure AD using the .Net app.

We will be using Visual Studio since it has many embedded features that will be useful for us when implementing single sign-on.

1. Open Visual Studio.
   
   
2. Go to File -> New -> Project and the following screen will appear.
   
   
   

4. Go to installed templates -> Visual C# ->Cloud ->QuickStarts ->App Services->Select Azure Active Directory: Web Authentication with OpenID Connect OWIN middleware.
   
   
5. Significance of using OpenID Connect Connect OWIN middleware template: By using the OpenID Connect middleware you don’t need to do anything extra apart from just passing the clientID and tenant URL which you have configured in Azure AD.Also by using the readymade template for OpenID connect OWIN middleware template automatically all the OpenID’s dlls get added in references.
   
   

6. Now open FilterConfig.cs file and add filters. Add (new AuthorizeAttribute ()) so as to display the login screen before the Home Page.
   
   
7. Also replace the values of client id and tenant in the web.config file with the actual values we have configured in azure AD while registering our application as shown below.
   
   
   
   
8. Make sure in the PostLogoutRedirectUri you set the project URL to your local projectURL and also this URL we need to register in the directory under which our application has been configured.
   
   We need to set this URL to SIGN-ON URL and REPLY URL in azure ad against the application which we have registered.
   
   For example in my case my project URL is: https://localhost:44320/ and I have set it to sign-on URL and reply URL to ad1tenant in the azure portal as shown in the below images.
   
   
   
   
   
   
9. Now let’s run the application locally with 2 different users myad1user (user of tenant AD1) and myad2user (user of tenant AD2).
   
   
10. First I sign in with myad1user.
    
    
    
    
    
    So as you can see from the above image I am able to sign in with myad1user.
    
    
11. But from multi-tenant point of view which is the main focus of our article let’s see if we are able to sign in with myad2user of another tenant AD2.
    
    
    
    

So as you can see from above images we are done we are able to sign in with user of another directory i.e. tenant as well.

Note: Once your web app is created please replace the following value of PostLogoutRedirectUri with the actual webapp URL.

<addkey="ida: PostLogoutRedirectUri"value="https://localhost:44320/" />

Also in the azure portal please replace the sign-on url and reply-url with the actual webapp url.

Now I have done with publishing of my application to webapp on azure, I will once again authenticate the app with my 2 user’s viz. myad1user (User in AD1 tenant) and myad2user (User in AD2 tenant).

As you can see from above images I am able to login to the azure published webapp with my 2 users viz. myad1user (User in AD1 tenant) and myad2user (User in AD2 tenant).

Summary

In the above article I have demonstrated the following things: