ASP.NET Core 8多租户Identity用户角色分配报错求助

1. 扩展IdentityRole添加租户ID字段 #

给角色实体新增AgentId（租户ID）属性，确保每个角色与对应租户绑定：

public class ApplicationRole : IdentityRole<Guid>
{
    public Guid AgentId { get; set; } // 关联租户的AgentId
}

2. 自定义UserStore重写角色查询逻辑 #

默认UserStore仅按角色名称查找，需重写AddToRoleAsync方法，加入租户ID筛选条件：

public class ApplicationUserStore : UserStore<ApplicationUser, ApplicationRole, ApplicationDbContext, Guid>
{
    private readonly Guid _currentAgentId;

    public ApplicationUserStore(ApplicationDbContext context, IOptions<IdentityOptions> optionsAccessor, 
        IPasswordHasher<ApplicationUser> passwordHasher, IEnumerable<IUserValidator<ApplicationUser>> userValidators, 
        IEnumerable<IPasswordValidator<ApplicationUser>> passwordValidators, ILookupNormalizer keyNormalizer, 
        IdentityErrorDescriber errors, IServiceProvider services, ILogger<UserStore<ApplicationUser, ApplicationRole, ApplicationDbContext, Guid>> logger,
        IHttpContextAccessor httpContextAccessor) : base(context, optionsAccessor, passwordHasher, userValidators, passwordValidators, keyNormalizer, errors, services, logger)
    {
        // 从当前请求上下文获取租户ID，根据实际场景调整获取方式
        _currentAgentId = Guid.Parse(httpContextAccessor.HttpContext.User.Claims.First(c => c.Type == "AgentId").Value);
    }

    public override async Task AddToRoleAsync(ApplicationUser user, string normalizedRoleName, CancellationToken cancellationToken = default)
    {
        // 按租户ID+角色名称筛选，确保找到唯一匹配的角色
        var targetRole = await Context.Roles
            .SingleOrDefaultAsync(r => r.NormalizedName == normalizedRoleName && r.AgentId == _currentAgentId, cancellationToken);

        if (targetRole == null)
        {
            throw new InvalidOperationException($"当前租户下不存在名为 {normalizedRoleName} 的角色");
        }

        await UserRoles.AddAsync(new IdentityUserRole<Guid> { UserId = user.Id, RoleId = targetRole.Id }, cancellationToken);
        await Context.SaveChangesAsync(cancellationToken);
    }
}

3. 注册自定义UserStore到依赖注入容器 #

在Program.cs中替换默认的UserStore实现：

builder.Services.AddIdentity<ApplicationUser, ApplicationRole>(options => options.SignIn.RequireConfirmedAccount = true)
    .AddEntityFrameworkStores<ApplicationDbContext>()
    .AddUserStore<ApplicationUserStore>() // 注册自定义UserStore
    .AddDefaultTokenProviders();

4. 可选：给RoleStore全局添加租户过滤 #

如果需要所有角色操作（如查询、删除）都自动带上租户筛选，可自定义ApplicationRoleStore：

public class ApplicationRoleStore : RoleStore<ApplicationRole, ApplicationDbContext, Guid>
{
    private readonly Guid _currentAgentId;

    public ApplicationRoleStore(ApplicationDbContext context, ILookupNormalizer keyNormalizer, IdentityErrorDescriber errors, 
        ILogger<RoleStore<ApplicationRole, ApplicationDbContext, Guid>> logger, IHttpContextAccessor httpContextAccessor) : base(context, keyNormalizer, errors, logger)
    {
        _currentAgentId = Guid.Parse(httpContextAccessor.HttpContext.User.Claims.First(c => c.Type == "AgentId").Value);
    }

    // 全局过滤当前租户的角色
    public override IQueryable<ApplicationRole> Roles => base.Roles.Where(r => r.AgentId == _currentAgentId);
}

注册该RoleStore：

builder.Services.AddIdentity<ApplicationUser, ApplicationRole>(options => options.SignIn.RequireConfirmedAccount = true)
    .AddEntityFrameworkStores<ApplicationDbContext>()
    .AddUserStore<ApplicationUserStore>()
    .AddRoleStore<ApplicationRoleStore>() // 注册自定义RoleStore
    .AddDefaultTokenProviders();

关键注意事项 #

• 租户ID的获取逻辑需匹配你的应用场景（比如从请求头、路由参数或用户Claim中提取）
• 所有角色创建操作必须正确赋值AgentId，避免出现无租户关联的角色
• 重写方法时尽量复用Identity原有逻辑，仅添加租户筛选逻辑，减少自定义代码复杂度

内容的提问来源于stack exchange，提问作者thanzeel