如何在AutoFac的ConfigureTenant中配置.NET Core多租户应用身份认证

.NET Core 认证中间件默认从根服务容器解析配置与服务，你将AddAuthentication相关逻辑注册到租户级Autofac容器后，全局中间件无法感知租户专属的JWT配置，所有认证逻辑还是沿用根容器的空配置，所以直接返回401未授权。

1. 替换全局认证方案提供器 #

默认的IAuthenticationSchemeProvider是根容器单实例，不支持租户级配置动态切换，需要自定义租户感知的实现：

public class TenantAuthenticationSchemeProvider : AuthenticationSchemeProvider
{
    private readonly ICurrentTenantContainerAccessor _currentTenantAccessor;
    public TenantAuthenticationSchemeProvider(IOptions<AuthenticationOptions> options, 
        ICurrentTenantContainerAccessor currentTenantAccessor) : base(options)
    {
        _currentTenantAccessor = currentTenantAccessor;
    }
    public override async Task<AuthenticationScheme> GetSchemeAsync(string name)
    {
        // 仅针对JWT方案走租户配置
        if (name == JwtBearerDefaults.AuthenticationScheme && _currentTenantAccessor.IsTenantResolved)
        {
            return new AuthenticationScheme(name, name, typeof(JwtBearerHandler));
        }
        return await base.GetSchemeAsync(name);
    }
}

2. 根容器基础认证注册 #

不要在租户容器内重复调用AddAuthentication，仅在根服务注册基础认证框架：

// 根容器Program/Startup 中注册
builder.Services.AddAuthentication(opt =>
{
    opt.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
    opt.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
});
// 替换默认的方案提供器
builder.Services.AddSingleton<IAuthenticationSchemeProvider, TenantAuthenticationSchemeProvider>();

3. 调整租户容器注册逻辑 #

仅在租户容器内注册专属JWT配置，不要重复注册整套认证服务：

public static MultitenantContainer ConfigureMultitenantContainer(IContainer container)
{
    // 注意这里要先初始化multitenantContainer实例，你原代码漏了这行
    var multitenantContainer = new MultitenantContainer(new TenantResolutionStrategy(), container);
    multitenantContainer.ConfigureTenant("80fdb3c0-5888-4295-bf40-ebee0e3cd8f3", containerBuilder =>
    {
        containerBuilder.RegisterType<DataService>().As<IDataService>().InstancePerDependency();
        containerBuilder.RegisterInstance(new OperationIdService()).SingleInstance();
        // 仅注册当前租户的JWT配置
        containerBuilder.Register(_ => Options.Create(new JwtBearerOptions
        {
            Authority = "https://key-cloak.cloudapp.azure.com:8443/auth/realms/test",
            Audience = "test",
            // 调试阶段可以加这个临时关闭HTTPS验证，生产环境要删掉
            // BackchannelHttpHandler = new HttpClientHandler { ServerCertificateCustomValidationCallback = (_, _, _, _) => true }
        })).As<IOptions<JwtBearerOptions>>().SingleInstance();
    });
    
    return multitenantContainer;
}

4. 补充服务解析适配 #

要保证认证中间件从租户容器解析服务，需要在UseAuthentication之前添加中间件，将HttpContext.RequestServices替换为当前租户生命周期Scope对应的服务提供器。

可以在JWT配置中添加错误回调定位具体问题：

options.Events = new JwtBearerEvents
{
    OnAuthenticationFailed = context =>
    {
        Console.WriteLine(context.Exception.Message);
        return Task.CompletedTask;
    }
};

内容的提问来源于stack exchange，提问作者Chandra Eskay