.NET Core多租户系统搭建咨询：含JWT与第三方登录

Hey Brian, 你的这个多租户系统设计思路非常贴合实际场景，刚好我之前在几个项目里落地过类似的方案，给你拆解下关键环节和可复用的代码示例，帮你把初步想法落地：

1. 基于Identity搭建基础账号体系 #

首先用ASP.NET Core Identity作为站点账号的核心管理框架，它天然支持第三方登录关联，我们只需要扩展用户实体增加多租户标识即可：

public class ApplicationUser : IdentityUser
{
    // 多租户核心标识，所有数据隔离的基础
    public Guid TenantId { get; set; }
    // 存储第三方登录关联信息
    public ICollection<IdentityUserLogin<string>> ExternalLogins { get; set; } = new List<IdentityUserLogin<string>>();
}

然后在Startup中配置Identity服务：

services.AddDbContext<ApplicationDbContext>(options =>
    options.UseSqlServer(Configuration.GetConnectionString("DefaultConnection")));

services.AddIdentity<ApplicationUser, IdentityRole>()
    .AddEntityFrameworkStores<ApplicationDbContext>()
    .AddDefaultTokenProviders();

2. 集成第三方登录（Azure AD、谷歌、Facebook） #

通过AddAuthentication统一管理认证方案，同时配置JWT作为API的默认认证方式，第三方登录用OpenID Connect做挑战：

services.AddAuthentication(options =>
{
    options.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = "oidc";
})
// JWT配置
.AddJwtBearer(options =>
{
    options.TokenValidationParameters = new TokenValidationParameters
    {
        ValidateIssuer = true,
        ValidateAudience = true,
        ValidateLifetime = true,
        ValidateIssuerSigningKey = true,
        ValidIssuer = Configuration["Jwt:Issuer"],
        ValidAudience = Configuration["Jwt:Audience"],
        IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(Configuration["Jwt:Key"]))
    };
})
// Azure AD配置（从appsettings读取）
.AddAzureAD(options => Configuration.Bind("AzureAd", options))
// 谷歌登录配置
.AddGoogle(options =>
{
    options.ClientId = Configuration["Authentication:Google:ClientId"];
    options.ClientSecret = Configuration["Authentication:Google:ClientSecret"];
})
// Facebook登录配置
.AddFacebook(options =>
{
    options.AppId = Configuration["Authentication:Facebook:AppId"];
    options.AppSecret = Configuration["Authentication:Facebook:AppSecret"];
});

别忘了在Configure中间件链中启用认证和授权：

app.UseAuthentication();
app.UseAuthorization();

3. 首次第三方登录的关联注册流程 #

核心逻辑是：用户通过第三方登录后，先检查是否已有站点账号关联该第三方身份；如果没有，引导用户完成基础注册，再绑定第三方登录信息：

[HttpGet]
public async Task<IActionResult> ExternalLoginCallback(string returnUrl = null, string remoteError = null)
{
    if (remoteError != null)
    {
        ModelState.AddModelError(string.Empty, $"第三方登录出错: {remoteError}");
        return View(nameof(Login));
    }
    var loginInfo = await _signInManager.GetExternalLoginInfoAsync();
    if (loginInfo == null) return RedirectToAction(nameof(Login));

    // 检查是否已有关联的站点账号
    var signInResult = await _signInManager.ExternalLoginSignInAsync(
        loginInfo.LoginProvider, loginInfo.ProviderKey, 
        isPersistent: false, bypassTwoFactor: true);

    if (signInResult.Succeeded)
    {
        // 生成带权限的JWT并跳转
        var user = await _userManager.FindByLoginAsync(loginInfo.LoginProvider, loginInfo.ProviderKey);
        var jwtToken = GenerateJwtToken(user);
        return RedirectToAction(nameof(Home.Index), new { token = jwtToken });
    }
    else if (signInResult.IsLockedOut)
    {
        return View(nameof(Lockout));
    }
    else
    {
        // 首次登录，引导注册关联
        var userEmail = loginInfo.Principal.FindFirstValue(ClaimTypes.Email);
        return View("ExternalLoginConfirmation", new ExternalLoginConfirmationViewModel 
        { 
            Email = userEmail, 
            ReturnUrl = returnUrl,
            // 这里可以根据业务逻辑预设TenantId，比如从域名/邀请链接获取
            TenantId = GetCurrentTenantId() 
        });
    }
}

[HttpPost]
public async Task<IActionResult> ExternalLoginConfirmation(ExternalLoginConfirmationViewModel model, string returnUrl = null)
{
    if (!ModelState.IsValid) return View(model);

    var loginInfo = await _signInManager.GetExternalLoginInfoAsync();
    if (loginInfo == null) return View("Error");

    // 创建站点账号并绑定第三方登录
    var newUser = new ApplicationUser 
    { 
        UserName = model.Email, 
        Email = model.Email, 
        TenantId = model.TenantId 
    };
    var createResult = await _userManager.CreateAsync(newUser);
    
    if (createResult.Succeeded)
    {
        var bindResult = await _userManager.AddLoginAsync(newUser, loginInfo);
        if (bindResult.Succeeded)
        {
            await _signInManager.SignInAsync(newUser, isPersistent: false);
            var jwtToken = GenerateJwtToken(newUser);
            return RedirectToLocal(returnUrl, jwtToken);
        }
        AddErrors(bindResult);
    }
    AddErrors(createResult);
    return View(model);
}

4. JWT令牌的权限映射 #

生成JWT时，要把用户的租户ID、角色、权限等核心信息嵌入Claims，API端就能基于这些Claims做精细化授权：

private async Task<string> GenerateJwtToken(ApplicationUser user)
{
    var claims = new List<Claim>
    {
        new Claim(JwtRegisteredClaimNames.Sub, user.Id),
        new Claim(JwtRegisteredClaimNames.Email, user.Email),
        // 嵌入租户ID，API端用于数据隔离
        new Claim("TenantId", user.TenantId.ToString()),
        new Claim(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString())
    };

    // 添加用户角色和角色对应的权限
    var userRoles = await _userManager.GetRolesAsync(user);
    foreach (var role in userRoles)
    {
        claims.Add(new Claim(ClaimTypes.Role, role));
        var roleClaims = await _roleManager.GetClaimsAsync(await _roleManager.FindByNameAsync(role));
        claims.AddRange(roleClaims);
    }

    var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(Configuration["Jwt:Key"]));
    var signingCreds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
    var expireTime = DateTime.Now.AddDays(Convert.ToDouble(Configuration["Jwt:ExpireDays"]));

    var token = new JwtSecurityToken(
        issuer: Configuration["Jwt:Issuer"],
        audience: Configuration["Jwt:Audience"],
        claims: claims,
        expires: expireTime,
        signingCredentials: signingCreds);

    return new JwtSecurityTokenHandler().WriteToken(token);
}

API端可以自定义授权策略，比如要求用户是当前租户的管理员：

services.AddAuthorization(options =>
{
    options.AddPolicy("TenantAdmin", policy =>
        policy.RequireClaim("TenantId")
              .RequireRole("Admin"));
});

然后在控制器中使用：

[Authorize(Policy = "TenantAdmin")]
[ApiController]
[Route("api/tenant")]
public class TenantController : ControllerBase
{
    // 仅当前租户管理员可访问的接口
    [HttpGet("settings")]
    public IActionResult GetTenantSettings()
    {
        var tenantId = User.FindFirstValue("TenantId");
        // 根据tenantId查询对应租户的配置
        return Ok(new { TenantId = tenantId, Settings = "..." });
    }
}

5. 多租户核心注意点 #

• 数据隔离：所有业务查询必须带上TenantId过滤，或者用数据库Schema、分库的方式实现物理隔离（根据业务规模选择）；
• 租户识别：首次注册时的租户ID可以通过邀请链接、请求域名、前端传入等方式确定，避免用户自行选择；
• 权限管控：角色和权限要与租户绑定，确保A租户的管理员无法访问B租户的资源。

内容的提问来源于stack exchange，提问作者Brian