Advanced Identity Management with IdentityServer5

In today’s evolving landscape of web applications and APIs, managing authentication and authorization securely and efficiently is more critical than ever. With the release of IdentityServer5, building advanced OAuth 2.0 and OpenID Connect (OIDC) solutions has never been easier—especially for complex scenarios like multi-tenant applications.

This post dives into how IdentityServer5 supports these advanced identity management needs and provides practical guidance for building secure, scalable identity infrastructures.

What’s New in IdentityServer5?

IdentityServer5 is the latest evolution of the popular open-source OpenID Connect and OAuth 2.0 framework for ASP.NET Core. It offers:

Improved protocol compliance and security updates.
Enhanced extensibility and customization.
First-class support for multi-tenant authentication scenarios.
Better integration with modern identity providers and standards.

OAuth 2.0 and OpenID Connect Refresher

Before diving deeper, a quick recap:

OAuth 2.0 is an authorization framework that enables delegated access to APIs.
OpenID Connect builds on OAuth 2.0 to add authentication (login) functionality.

IdentityServer5 acts as a central authority managing tokens, user identity, and access control—enabling single sign-on (SSO), API protection, and identity federation.

Multi-Tenant Identity Management Challenges

Multi-tenant apps serve multiple clients or organizations from a shared infrastructure. This setup poses several challenges:

Tenant isolation: Separate users, roles, and data per tenant.
Configurable authentication: Different tenants might use different identity providers or policies.
Security boundaries: Prevent tenant A from accessing tenant B’s data.

IdentityServer5 provides tools and patterns to handle these challenges effectively.

Implementing Multi-Tenant Authentication with IdentityServer5

1. Tenant-aware Configuration

You can load tenant-specific configuration dynamically during the authentication pipeline. For example, customize client settings or identity provider metadata per tenant.

services.AddIdentityServer(options =>
{
    options.IssuerUri = "https://auth.example.com";
})
.AddInMemoryClients(GetClientsForTenant(tenantId))
.AddInMemoryIdentityResources(GetIdentityResources())
.AddInMemoryApiScopes(GetApiScopes())
.AddDeveloperSigningCredential();

IEnumerable<Client> GetClientsForTenant(string tenantId)
{
    // Load clients from DB or config filtered by tenantId
    return tenantId switch
    {
        "tenantA" => new List<Client> { /* Tenant A clients */ },
        "tenantB" => new List<Client> { /* Tenant B clients */ },
        _ => new List<Client>()
    };
}

2. Tenant Resolution Middleware

Add middleware early in the pipeline to resolve the tenant from request context (e.g., subdomain, headers).

app.Use(async (context, next) =>
{
    var host = context.Request.Host.Host;
    context.Items["TenantId"] = ResolveTenantFromHost(host);
    await next();
});

Then inject tenant info wherever needed in IdentityServer pipeline.

3. Securing APIs by Tenant

Use scopes and claims to enforce tenant boundaries on resource servers.

services.AddAuthorization(options =>
{
    options.AddPolicy("TenantPolicy", policy =>
        policy.RequireClaim("tenant_id", currentTenantId));
});

4. Advanced OAuth Flows

IdentityServer5 supports advanced OAuth 2.0 flows, including:

Device Code flow — for devices with limited input capabilities.
Token Exchange — for delegating tokens between services.
PKCE (Proof Key for Code Exchange) — improving authorization code flow security.

Example: Integrating External Identity Providers per Tenant

Imagine tenant A uses Azure AD, tenant B uses Google as their identity provider. IdentityServer5 allows dynamic external provider registration:

services.AddAuthentication()
    .AddOpenIdConnect("AzureAD", "Azure AD", options =>
    {
        // Azure AD config for tenant A
    })
    .AddGoogle("Google", options =>
    {
        // Google config for tenant B
    });

Load and activate the right provider based on the tenant at runtime.

Conclusion

IdentityServer5 is a robust platform for implementing modern identity solutions with advanced OAuth 2.0 and OpenID Connect features. Its support for multi-tenant scenarios helps build scalable, secure applications that respect tenant boundaries while enabling seamless user experiences.

If you’re building a SaaS platform or a complex API ecosystem, investing time in mastering IdentityServer5 is well worth it.

Next Steps

Deep dive into token customization and claims enrichment.
Implement consent management flows.
Explore IdentityServer5 integration with Azure AD B2C or other external IdPs.