How does Azure AD MutiTenant authentication works?

Question

I want to enable Multitenant Authentication. My Code is in ASP.Net Webforms and Here is the StartUp.cs file code.

  public partial class Startup
{

    const string MSATenantId = "XXXXXXXXXXXXXXX";
    private static string clientId = ConfigurationManager.AppSettings["ida:ClientID"];
    private static string aadInstance = EnsureTrailingSlash(ConfigurationManager.AppSettings["ida:AADInstance"]);
    private static string authority = aadInstance + "common";

    public void ConfigureAuth(IAppBuilder app)
    {
        app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);

        app.UseCookieAuthentication(new CookieAuthenticationOptions { });

        // instead of using the default validation (validating against a single issuer value, as we do in line of business apps), 
        // we inject our own multitenant validation logic
        app.UseOpenIdConnectAuthentication(
            new OpenIdConnectAuthenticationOptions
            {
                ClientId = clientId,
                Authority = authority,
                TokenValidationParameters = new Microsoft.IdentityModel.Tokens.TokenValidationParameters
                {
                    ValidateIssuer = true,
                     ValidIssuers = new List<string>()
                     {
                         "https://sts/windows.net/XXXXXXXXXXXX"
                     }
                    // If the app needs access to the entire organization, then add the logic
                    // of validating the Issuer here.
                    // IssuerValidator
                },
                Notifications = new OpenIdConnectAuthenticationNotifications()
                {   
                    SecurityTokenValidated = (context) =>
                    {

                        //if (context.AuthenticationTicket.Identity.FindFirst("http://schemas.microsoft.com/identity/claims/tenantid").Value != MSATenantId)
                        //{
                        //     context.HandleResponse();
                        //    context.Response.Redirect("InvalidUser.aspx");
                        //}
                        // If your authentication logic is based on users
                        return Task.FromResult(0);
                    },
                    AuthenticationFailed = (context) =>
                    {
                        // Pass in the context back to the app
                        context.HandleResponse();
                        // Suppress the exception
                        return Task.FromResult(0);
                    }
                },  
            });

        // This makes any middleware defined above this line run before the Authorization rule is applied in web.config
        app.UseStageMarker(PipelineStage.Authenticate);
    }
    //private Task OnSecurityTokenValidatedAsync(SecurityTokenValidatedNotification<OpenIdConnectMessage, OpenIdConnectAuthenticationOptions> notification)
    //{
    //    // Make sure that the user didn't sign in with a personal Microsoft account
    //    if (notification.AuthenticationTicket.Identity.FindFirst("http://schemas.microsoft.com/identity/claims/tenantid").Value == MSATenantId)
    //    {
    //        notification.HandleResponse();
    //        notification.Response.Redirect("/Account/UserMismatch");
    //    }

    //    return Task.FromResult(0);
    //}
   }

I want only the user with the MSATenantId should able to access the application for that I have read there are multiple ways I have tried below two though both are not working:

1. In this the application doesn't redirect to the Home page

        TokenValidationParameters = new Microsoft.IdentityModel.Tokens.TokenValidationParameters
                {
                   ValidateIssuer = true,
                    ValidIssuers = new List<string>()
                    {
                        "https://sts/windows.net/XXXXXXXXXX"
                    }
                   // If the app needs access to the entire organization, then add the logic
                   // of validating the Issuer here.
                   // IssuerValidator
               },
   

2.     In this it doesn't redirect to invalid page.
             SecurityTokenValidated = (context) =>
                    {
   
                        if (context.AuthenticationTicket.Identity.FindFirst("http://schemas.microsoft.com/identity/claims/tenantid").Value != MSATenantId)
                        {
                            context.HandleResponse();
                            context.Response.Redirect("InvalidUser.aspx");
                        }
                        If your authentication logic is based on users
                        return Task.FromResult(0);
                    },
   

Am I missing anything or do I need to add something in the above scenarios. I want to just test with one Tenant first and then I'll add more tenant.

Also, how does the 1 and 2 are different ?

This works if I don't use any of the above option. I am able to login with Azure account.

Answer 1

Your question has been resolved, add it as the answer to the end of the question.

Your issuer is set incorrectly, you should change it to: https://sts.windows.net/XXXXXXXXXXXX/.