IdentityServer4多租户场景下限制用户登录指定客户端的实现咨询

Great question! This is a super common requirement for multi-tenant IdentityServer4 deployments, and yes—plenty of developers have implemented this successfully. Let’s break down how to make this work exactly as you described:

First, you’ll need to model three key relationships:

• Each user is linked to one (or multiple, if needed) tenant
• Each client is assigned to one or more tenants
• IdentityServer will validate that a logged-in user’s tenant matches the client’s allowed tenants before granting access

1. Extend Your Data Models #

Start by adding tenant-related fields to your user and client entities:

• For users: Add a TenantId (or TenantIds for multi-tenant users) property to your ApplicationUser class (if using ASP.NET Identity)
• For clients: Use the built-in Properties dictionary to store allowed tenant IDs as a comma-separated string (or extend the Client entity directly if using EF Core for persistence)

2. Add Tenant Claims to Authenticated Users #

When a user logs in, ensure their tenant ID is added to their claims principal so IdentityServer can access it later. In your login logic (e.g., AccountController):

// After validating user credentials
var user = await _userManager.FindByNameAsync(model.Username);
var claims = new List<Claim>
{
    new Claim(ClaimTypes.Name, user.UserName),
    new Claim("tenant_id", user.TenantId.ToString()),
    // Add other required claims here
};

var identity = new ClaimsIdentity(claims, "password");
var principal = new ClaimsPrincipal(identity);

// Sign the user in with the tenant claim included
await HttpContext.SignInAsync(IdentityConstants.ApplicationScheme, principal);

3. Implement a Custom Authorize Request Validator #

This is the core of the tenant check. Use IdentityServer4’s ICustomAuthorizeRequestValidator extension point to validate that the logged-in user’s tenant is allowed to access the requested client:

public class TenantRestrictedAuthorizeValidator : ICustomAuthorizeRequestValidator
{
    private readonly IClientStore _clientStore;
    private readonly IHttpContextAccessor _httpContextAccessor;

    public TenantRestrictedAuthorizeValidator(IClientStore clientStore, IHttpContextAccessor httpContextAccessor)
    {
        _clientStore = clientStore;
        _httpContextAccessor = httpContextAccessor;
    }

    public async Task ValidateAsync(CustomAuthorizeRequestValidationContext context)
    {
        var validatedRequest = context.Result.ValidatedRequest;
        var client = await _clientStore.FindClientByIdAsync(validatedRequest.ClientId);
        var currentUser = _httpContextAccessor.HttpContext.User;

        // Skip check if user isn't authenticated (let normal login flow handle it)
        if (!currentUser.Identity.IsAuthenticated) return;

        // Get user's tenant ID from claims
        var userTenantId = currentUser.FindFirstValue("tenant_id");
        if (string.IsNullOrEmpty(userTenantId))
        {
            context.Result.Error = "invalid_tenant";
            context.Result.ErrorDescription = "User has no associated tenant.";
            return;
        }

        // Get allowed tenants for the client
        if (!client.Properties.TryGetValue("allowed_tenants", out var allowedTenantsStr))
        {
            context.Result.Error = "client_not_configured";
            context.Result.ErrorDescription = "Client has no tenant restrictions configured.";
            return;
        }

        var allowedTenants = allowedTenantsStr.Split(',', StringSplitOptions.RemoveEmptyEntries);
        if (!allowedTenants.Contains(userTenantId))
        {
            // Clear current auth session and redirect to login
            await _httpContextAccessor.HttpContext.SignOutAsync();
            context.Result.Error = "access_denied";
            context.Result.ErrorDescription = "You are not authorized to access this application.";
            context.Result.RedirectUri = "/Account/Login"; // Your login page path
        }
    }
}

Register this validator in your Program.cs (or Startup.cs for older .NET versions):

services.AddTransient<ICustomAuthorizeRequestValidator, TenantRestrictedAuthorizeValidator>();

4. Configure Clients with Tenant Restrictions #

When setting up your clients, add the allowed_tenants property to specify which tenants can access them:

new Client
{
    ClientId = "tenant1-app1",
    ClientName = "Tenant 1's First Application",
    // Other client settings (grant types, redirect URIs, etc.)
    Properties = new Dictionary<string, string>
    {
        { "allowed_tenants", "tenant1" } // Only users from tenant1 can access this client
    }
}

• Unauthenticated Users: If a user hasn’t logged in yet and tries to access a restricted client, IdentityServer will automatically redirect them to the login page—exactly what you want.
• Cross-Tenant SSO: If a user is logged in to a tenant1 client and tries to access a tenant2 client, the validator will clear their current session and send them to login, forcing them to use a tenant2 account.
• Multi-Tenant Users: If you need users to access multiple tenants, adjust the claim to include a list of tenant IDs and modify the validator to check if any of the user’s tenants are in the client’s allowed list.

This approach is battle-tested—many teams use this exact pattern in production to enforce tenant-based client access while preserving SSO within each tenant group.

内容的提问来源于stack exchange，提问作者Jay