ASP.NET Core多租户：SaasKit的UsePerTenant与IOptions结合实现咨询

Great question! Combining SaasKit's tenant-aware middleware with per-tenant IOptions is a clean pattern for multi-tenant auth scenarios, and it’s straightforward once you map out the pieces. Let’s walk through how to implement this step by step.

1. Define Tenant-Specific Authentication Options #

First, create a class to hold your tenant-specific auth configuration. This isolates settings like JWT issuers, secret keys, or cookie names so each tenant can have unique values:

public class TenantAuthOptions
{
    public string JwtIssuer { get; set; }
    public string JwtSecretKey { get; set; }
    public int JwtExpirationMinutes { get; set; } = 60;
    // Add other auth-related settings your app needs (e.g., cookie name for cookie auth)
}

2. Register Per-Tenant Configuration in DI #

Next, wire up these options so SaasKit can resolve the correct config for the current tenant. You’ll load these settings from a database, appsettings.json, or an external service—here’s how to bind it with SaasKit’s tenant-aware DI:

First, make sure your tenant resolver (like HostTenantResolver) is registered as usual. Then, register a factory that fetches TenantAuthOptions for the active tenant:

services.AddPerTenant<TenantAuthOptions>((provider, tenant) =>
{
    // Replace this with your actual logic to load tenant-specific config
    // Example: Fetch from a database using tenant.Id
    var dbContext = provider.GetRequiredService<AppDbContext>();
    var tenantConfig = dbContext.TenantAuthConfigs
        .FirstOrDefault(t => t.TenantId == tenant.Id);

    // Fallback to default options if no tenant-specific config exists
    return tenantConfig?.MapToTenantAuthOptions() ?? new TenantAuthOptions();
});

If you’re using appsettings.json with tenant-specific sections, you can bind directly from config:

services.AddPerTenant<TenantAuthOptions>((provider, tenant) =>
{
    var config = provider.GetRequiredService<IConfiguration>();
    var tenantAuthSection = config.GetSection($"Tenants:{tenant.Id}:Authentication");
    var options = new TenantAuthOptions();
    tenantAuthSection.Bind(options);
    return options;
});

3. Use UsePerTenant to Configure Authentication Middleware #

Now, in your Configure method, wrap your auth setup in UsePerTenant to dynamically apply tenant-specific settings. Here’s an example with JWT Bearer authentication:

app.UseRouting();

// Run tenant resolver first to ensure the tenant is identified before auth
app.UseTenantResolver();

// Wrap auth configuration in UsePerTenant to make it tenant-aware
app.UsePerTenant(async (context, tenant) =>
{
    var tenantAuthOptions = context.RequestServices
        .GetRequiredService<IOptions<TenantAuthOptions>>()
        .Value;

    // Configure JWT Bearer with tenant-specific values
    var jwtOptions = new JwtBearerOptions
    {
        TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = true,
            ValidIssuer = tenantAuthOptions.JwtIssuer,
            ValidateAudience = false,
            ValidateIssuerSigningKey = true,
            IssuerSigningKey = new SymmetricSecurityKey(
                Encoding.UTF8.GetBytes(tenantAuthOptions.JwtSecretKey)
            ),
            ClockSkew = TimeSpan.Zero
        }
    };

    context.UseJwtBearerAuthentication(jwtOptions);
    context.UseAuthentication();
    context.UseAuthorization();

    await Task.CompletedTask;
});

app.UseEndpoints(endpoints =>
{
    endpoints.MapControllers();
});

Key Tips for Smooth Implementation #

• Tenant Resolution Order: Always call UseTenantResolver before UsePerTenant—SaasKit needs to identify the tenant first to fetch the correct config.
• Caching: Add caching to your tenant config loader (e.g., using IDistributedCache) to avoid repeated database or config reads on every request.
• Fallback Values: Never skip fallback options—if a tenant doesn’t have custom settings, default values will prevent runtime errors.
• Other Auth Schemes: This pattern works for any auth type (Cookie, OAuth, etc.). Just adjust the middleware configuration inside UsePerTenant to use the tenant-specific options.

That’s it! This setup lets you dynamically apply authentication settings per tenant using SaasKit and IOptions.

内容的提问来源于stack exchange，提问作者Jonas