如何在多租户环境中扩展Asp.Net Core Identity的用户认证与管理？

我来帮你梳理下新版Asp.Net Core Identity适配多域名（多租户）的具体方案，结合你已经给ApplicationUser扩展了DomainId字段、且已有可用多租户系统的前提，分几个核心部分来说明：

新版Asp.Net Core Identity的设计本身就偏向可扩展，不需要完全推翻原有逻辑，重点是让所有用户相关的操作（注册、查询、认证）自动结合当前请求的DomainId做过滤和校验，确保不同域名下的用户数据完全隔离。

1.1 重写UserStore<TUser> #

这是和数据库交互的核心组件，所有用户的CRUD操作都会经过它。我们需要改造它，让所有查询自动带上DomainId过滤，创建用户时自动赋值当前DomainId：

public class TenantUserStore : UserStore<ApplicationUser>
{
    private readonly ITenantService _tenantService; // 你的多租户服务，用来获取当前DomainId

    public TenantUserStore(ApplicationDbContext context, 
                           ITenantService tenantService,
                           IOptions<IdentityOptions> optionsAccessor = null,
                           IPasswordHasher<ApplicationUser> passwordHasher = null,
                           IEnumerable<IUserValidator<ApplicationUser>> userValidators = null,
                           IEnumerable<IPasswordValidator<ApplicationUser>> passwordValidators = null,
                           ILookupNormalizer keyNormalizer = null,
                           IdentityErrorDescriber errors = null,
                           IServiceProvider services = null,
                           ILogger<UserStore<ApplicationUser>> logger = null) 
        : base(context, optionsAccessor, passwordHasher, userValidators, passwordValidators, keyNormalizer, errors, services, logger)
    {
        _tenantService = tenantService;
    }

    // 按用户名查询时，结合DomainId过滤
    public override async Task<ApplicationUser> FindByNameAsync(string normalizedUserName, CancellationToken cancellationToken = default)
    {
        var currentDomainId = _tenantService.GetCurrentDomainId();
        return await Users.FirstOrDefaultAsync(u => 
            u.NormalizedUserName == normalizedUserName && u.DomainId == currentDomainId, 
            cancellationToken);
    }

    // 按邮箱查询时，结合DomainId过滤
    public override async Task<ApplicationUser> FindByEmailAsync(string normalizedEmail, CancellationToken cancellationToken = default)
    {
        var currentDomainId = _tenantService.GetCurrentDomainId();
        return await Users.FirstOrDefaultAsync(u => 
            u.NormalizedEmail == normalizedEmail && u.DomainId == currentDomainId, 
            cancellationToken);
    }

    // 创建用户时自动赋值当前DomainId
    public override async Task<IdentityResult> CreateAsync(ApplicationUser user, CancellationToken cancellationToken = default)
    {
        user.DomainId = _tenantService.GetCurrentDomainId();
        return await base.CreateAsync(user, cancellationToken);
    }

    // 可选：重写GetUsersAsync，默认只返回当前Domain下的用户
    public override IQueryable<ApplicationUser> Users => 
        base.Users.Where(u => u.DomainId == _tenantService.GetCurrentDomainId());
}

写完后记得在Program.cs里替换默认的UserStore：

builder.Services.AddScoped<IUserStore<ApplicationUser>, TenantUserStore>();

1.2 自定义用户验证器（UserValidator<TUser>） #

默认的Identity会全局校验用户名/邮箱唯一性，我们需要改成同一域名下唯一，所以要自定义验证逻辑：

public class TenantUserValidator : UserValidator<ApplicationUser>
{
    private readonly ITenantService _tenantService;

    public TenantUserValidator(ITenantService tenantService, IOptions<IdentityOptions> optionsAccessor) 
        : base(optionsAccessor)
    {
        _tenantService = tenantService;
    }

    public override async Task<IdentityResult> ValidateAsync(UserManager<ApplicationUser> manager, ApplicationUser user)
    {
        var baseResult = await base.ValidateAsync(manager, user);
        var currentDomainId = _tenantService.GetCurrentDomainId();

        // 校验当前域名下用户名是否重复
        var existingUser = await manager.FindByNameAsync(user.UserName);
        if (existingUser != null && existingUser.Id != user.Id && existingUser.DomainId == currentDomainId)
        {
            return IdentityResult.Failed(new IdentityError { Description = "该用户名在当前域名下已存在" });
        }

        // 校验当前域名下邮箱是否重复（如果开启了邮箱唯一配置）
        if (manager.Options.User.RequireUniqueEmail)
        {
            var existingEmailUser = await manager.FindByEmailAsync(user.Email);
            if (existingEmailUser != null && existingEmailUser.Id != user.Id && existingEmailUser.DomainId == currentDomainId)
            {
                return IdentityResult.Failed(new IdentityError { Description = "该邮箱在当前域名下已存在" });
            }
        }

        return baseResult;
    }
}

然后在Identity注册时替换默认验证器：

builder.Services.AddDefaultIdentity<ApplicationUser>(options => options.SignIn.RequireConfirmedAccount = true)
    .AddEntityFrameworkStores<ApplicationDbContext>()
    .AddUserValidator<TenantUserValidator>(); // 替换为自定义验证器

1.3 扩展SignInManager<TUser>（可选但推荐） #

为了确保登录时用户的DomainId和当前请求的域名匹配，可以扩展登录逻辑：

public class TenantSignInManager : SignInManager<ApplicationUser>
{
    private readonly ITenantService _tenantService;

    public TenantSignInManager(UserManager<ApplicationUser> userManager,
                               IHttpContextAccessor contextAccessor,
                               IUserClaimsPrincipalFactory<ApplicationUser> claimsFactory,
                               IOptions<IdentityOptions> optionsAccessor,
                               ILogger<SignInManager<ApplicationUser>> logger,
                               IAuthenticationSchemeProvider schemes,
                               IUserConfirmation<ApplicationUser> confirmation) 
        : base(userManager, contextAccessor, claimsFactory, optionsAccessor, logger, schemes, confirmation)
    {
        _tenantService = tenantService;
    }

    public override async Task<SignInResult> PasswordSignInAsync(string userName, string password, bool isPersistent, bool lockoutOnFailure)
    {
        var currentDomainId = _tenantService.GetCurrentDomainId();
        var user = await UserManager.FindByNameAsync(userName);
        
        // 如果用户不存在，或者用户的DomainId和当前域名不匹配，直接返回登录失败
        if (user == null || user.DomainId != currentDomainId)
        {
            return SignInResult.Failed;
        }

        return await base.PasswordSignInAsync(userName, password, isPersistent, lockoutOnFailure);
    }
}

同样在Program.cs里注册：

builder.Services.AddScoped<SignInManager<ApplicationUser>, TenantSignInManager>();

为了避免数据层面的冲突，建议给ApplicationUser表添加两个唯一索引：

• UserName + DomainId 的唯一索引
• Email + DomainId 的唯一索引（如果开启了邮箱唯一）

• 所有操作都通过你的多租户服务获取DomainId，不要硬编码
• 如果后续涉及角色、权限管理，同样需要扩展RoleStore等组件，添加DomainId过滤逻辑
• 测试时要覆盖跨域名的用户注册、登录场景，确保数据隔离有效

内容的提问来源于stack exchange，提问作者martonx