client specific claims identity server4 using asp.net core identity

Question

We need to make a central auth server for multiple applications that we build, while still having roles and claims which are specific to that particular application. Let me explain with an analogy using various services by Microsoft.

I sign up for a Microsoft account and hence my authentication info is stored in a central server. Now i login using the account and assume a fresh start i land up at account.microsoft.com, now i go to msdn click on sign in, it takes me to the login page on auth server then to the consent screen and back to msdn logged in, now i go to xbox and does the same thing. Now MDSN and XBOX are two completely different applications with each having it's own Api, web apps and mobile apps, but using the same auth server.

Till now i have been making independent applications using Identity Framework, and am reasonably comfortable with it, but this is comparatively much more complex than what i have done till now. I was looking through IdentityServer4 to have a central auth server and has completed all the tutorials present on the official doc site, so i have a basic idea of the concepts.

What i need is to have each application be able to specify it's own set of roles and claims without even having any kind of knowledge about other applications, and also the central server will be having external authentications enabled, hence ASP.NET Core Identity in central server.

Current Architecture

1. Central Identity Server (using IdentityServer4, ASP.NET Core Identity, Entity Framework)
2. One Central DB for Central Server
3. Multiple Applications Sets (API, MVC App, Xamarin Mobile Apps)
4. One or more DB for each application as per need

Things i am able to achieve till now

1. Customize an identity resource to get user claims stored in db but if i add one roles, it returns me the role repeatedly the number of times as the count of API resources and Clients

Alternate solutions that i came up in my mind

1. Store the claims and roles in application specific DB, but i guess that i will be facing these issues
   • too much effort wiring up the auth logic, as it will have to first get the identity from central server and then get claims from the application specific DB
   • not sure how i can do it using asp.net identity on client side
   • unused table on central auth server
   • duplication of auth logic across applications

These stack overflow questions gets the most closest but are not the exact solution

• ASP.NET Core Identity and Identity Server 4 - [Roles, Claims and IdentityResources]
• IdentityServer, Claims and Roles
• How to add additional claims to be included in the access_token using ASP.Net Identity with IdentityServer4

Any guidance that takes me in the right direction will help

EDIT #1 : It seems like someone has flagged this questions as off-topic, so just want to clarify that i am looking for a specific code/solution using identity server 4 and asp.net core identity and not some recommendation, though any guidance apart from the answer is welcome for better clarifications and understanding, but just the code would suffice, and i feel that it's as per the guidelines of the community.

EDIT #2 I tried doing authorization on client side as suggested by @travis.js but i am unable to understand how do i implement the claims on client side something like [Authorize(Roles="Admin")]

Answer 1

I think your alternative solution is the "right" one.

Addressing your concerns:

too much effort wiring up the auth logic, as it will have to first get the identity from central server and then get claims from the application specific DB

Sounds like exactly the right amount of effort to me. The Central Server does authentication and each app does its own authorization.

not sure how i can do it using asp.net identity on client side

You don't really need ASP.NET Identity on the client/app side. Identity is handled by your central server.

unused table on central auth server

Non-issue. But you could still use that table for its intended purpose just at a more macro level.

duplication of auth logic across applications

This does not sound like a duplication of logic. The Central Server does identity/authentication and each app is responsible for determining its own authorization logic.