Multi-tenancy support

[fmattioli]

I would like to ask you, I faced a situation where it was necessary for me to work with multi tenancy on keycloak.
Using this package, I made some changes, and it is working fine for me.
Basically, each realm on my keycloak is a tenant in my application.
I was thinking if it maybe could be util for you and if yes, share the code with you, collect opinions, change the code if necessary and maybe if be of your interest you can englobe this feature on official documentation.
Maybe it is a polemic theme work with multi tenancy on Keycloak, but maybe what I did could be useful and if it really be, I will be happy sharing what I did to solve my problem about transforming my app in multi tenancy using this project.
Thank you.

[NikiforovAll]

Hi @fmattioli , thank you for reaching out. I would like to see it as part of this package eventually. Let's see what you have got!

[fmattioli]

I will share the code, maybe somethings does not make sense, but in my case it solve my problem:
Basically, I did an extension of a ServiceCollection, I keep using methods from your library but I did some changes to add support to multi tenancy.

Service extension:

using Contracts.Web.Services.Auth;
using Keycloak.AuthServices.Authentication;
using Keycloak.AuthServices.Authorization;
using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.AspNetCore.Http;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.IdentityModel.Tokens;
using System.IdentityModel.Tokens.Jwt;

namespace Contracts.Web.ServiceCollectionExtensions.KeycloakAuth
{
    public static class KeycloakAuthExtension
    {
        public static IServiceCollection AddKeyCloakAuth(this IServiceCollection services, AuthSettings authSettings)
        {
            var httpClient = new HttpClient();
            var tokenHandler = new JwtSecurityTokenHandler();

            services
                .AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
                .AddKeycloakWebApi(
                    options =>
                    {
                        options.Resource = authSettings.Resource!;
                        options.AuthServerUrl = authSettings.AuthServerUrl;
                        options.VerifyTokenAudience = true;
                    },
                    options =>
                    {
                        options.Events = new JwtBearerEvents
                        {
                            OnMessageReceived = async context =>
                            {
                                try
                                {
                                    var tokenJwt = context.Request.Headers.Authorization.FirstOrDefault();

                                    if (string.IsNullOrEmpty(tokenJwt))
                                    {
                                        context.HttpContext.Items["AuthError"] = "Invalid JWT token provided! Please check. ";
                                        context.HttpContext.Items["AuthStatusCode"] = 401;
                                        return;
                                    }

                                    var bearerToken = tokenJwt.Replace("Bearer ", "");
                                    var tokenInfos = tokenHandler.ReadJwtToken(tokenJwt.Replace("Bearer ", ""));
                                    var tenantNumber = tokenInfos.Claims.FirstOrDefault(c => c.Type == "tenant")?.Value;
                                    var tenantRealm = authSettings.Realms.FirstOrDefault(realm => realm.Name == tenantNumber);

                                    if (tenantRealm is null)
                                    {
                                        context.HttpContext.Items["AuthError"] = "This token don't belongs to valid tenant. Please check!";
                                        context.HttpContext.Items["AuthStatusCode"] = 401;
                                        context.NoResult();
                                        return;
                                    }

                                    var audience = tokenInfos.Claims.FirstOrDefault(c => c.Type == "aud")?.Value;
                                    if (string.IsNullOrEmpty(audience))
                                    {
                                        context.HttpContext.Items["AuthError"] = "Invalid scope provided! Please, check the scopes provided!";
                                        context.HttpContext.Items["AuthStatusCode"] = 403;
                                        context.NoResult();
                                        return;
                                    }

                                    var jwksUrl = $"{tenantRealm.Issuer}/protocol/openid-connect/certs";

                                    var jwks = await httpClient.GetStringAsync(jwksUrl);
                                    var jsonWebKeySet = new JsonWebKeySet(jwks);

                                    var tokenValidationParameters = new TokenValidationParameters
                                    {
                                        ValidateIssuer = true,
                                        ValidIssuer = tenantRealm.Issuer,
                                        ValidateAudience = true,
                                        ValidAudience = tenantRealm.Audience,
                                        ValidateLifetime = true,
                                        ValidateIssuerSigningKey = true,
                                        IssuerSigningKeys = jsonWebKeySet.Keys
                                    };

                                    var claims = tokenHandler.ValidateToken(bearerToken, tokenValidationParameters, out var validatedToken);
                                    context.Principal = claims;
                                    context.Success();
                                }
                                catch (Exception e)
                                {
                                    context.Response.StatusCode = 500;
                                    context.Fail("The following error occurs during the authentication process: " + e.Message);
                                }
                            },
                            OnAuthenticationFailed = async context =>
                            {
                                var errorDescription = context.Exception.Message;
                                context.Response.StatusCode = 401;
                                context.Response.ContentType = "application/json";
                                await context.Response.WriteAsJsonAsync(errorDescription);
                            },
                            OnChallenge = async context =>
                            {
                                if (!context.Response.HasStarted)
                                {
                                    var errorMessage = context.HttpContext.Items["AuthError"] as string ?? "Authentication failed!";
                                    var statusCode = context.HttpContext.Items["AuthStatusCode"] as int? ?? 401;
                                    var responseMessage = new { Message = errorMessage };
                                    context.Response.StatusCode = statusCode;
                                    context.Response.ContentType = "application/json";
                                    await context.Response.WriteAsJsonAsync(responseMessage);
                                }
                                context.HandleResponse();
                            }
                        };
                    }
                );

            services
                .AddAuthorization()
                .AddKeycloakAuthorization()
                .AddAuthorizationBuilder()
                .AddPolicy(
                    authSettings.PolicyName!,
                    policy =>
                    {
                        policy.RequireResourceRolesForClient(
                            authSettings!.Resource!,
                            authSettings!.Roles!.ToArray());
                    }
                );

            services.AddSingleton<JwtSecurityTokenHandler>()
                    .AddScoped<IAuthService, AuthService>();

            return services;
        }
    }
}

Helpful methods that I need on my application to get details about the token:

using Microsoft.AspNetCore.Http;
using System.IdentityModel.Tokens.Jwt;

namespace Contracts.Web.Services.Auth
{
    public class AuthService(IHttpContextAccessor httpContextAccessor, JwtSecurityTokenHandler jwtSecurityTokenHandler) : IAuthService
    {
        private readonly IHttpContextAccessor _httpContextAccessor = httpContextAccessor;
        private readonly JwtSecurityTokenHandler _tokenHandler = jwtSecurityTokenHandler;

        public int GetTenant()
        {
            string jwtToken = GetToken();
            var tokenInfos = _tokenHandler.ReadJwtToken(jwtToken);
            var tenantClaim = tokenInfos.Claims.FirstOrDefault(c => c.Type == "tenant")?.Value!;
            return int.Parse(tenantClaim);
        }

        public Guid GetUser()
        {
            string jwtToken = GetToken();
            var tokenInfos = _tokenHandler.ReadJwtToken(jwtToken);
            var userClaim = tokenInfos.Claims.FirstOrDefault(c => c.Type == "sub")?.Value!;
            return Guid.Parse(userClaim);
        }

        private string GetToken()
        {
            var authorizationHeader = _httpContextAccessor.HttpContext!.Request.Headers.Authorization.FirstOrDefault();
            return authorizationHeader!.Replace("Bearer ", string.Empty);
        }
    }
}

And for finish, a model that was necessary to me create and fill it out to handle the tenants from my application. When I am calling the AddKeyCloakAuth method, I inform the tenants that is able to use my application.

namespace Contracts.Web.ServiceCollectionExtensions.KeycloakAuth
{
    public class AuthSettings
    {
        public IEnumerable<Realm> Realms { get; set; } = [];
        public string? ClientId { get; set; }
        public string? Resource { get; set; }
        public string? AuthServerUrl { get; set; }
        public string? PolicyName { get; set; }
        public IEnumerable<string>? Roles { get; set; }
        public IEnumerable<string>? Scopes { get; set; }
    }

    public class Realm
    {
        public string? Name { get; set; }
        public string? Audience { get; set; }
        public string? Issuer { get; set; }
    }
}

Anyway, this initiative is only an action to maybe help someone in a near future who needs to implement multi tenancy following this amazing package that you build.
When I was implementing it, I saw many things about the use of Multitenancy on keycloak, and for this reason I decided to share it with you.
Thank you. Hugs from Brasil :)

[NikiforovAll]

Thank you very much. I appreciate your input. 🙏

[savva-andreas]

Hi,

How can multi-tenancy be supported in a Protected Resource Authorization scenario?

I am following the ResourceAuthorization project example. Seems that this code (see Program.cs) will need to be changed:

AddAccessTokenManagement(builder, services);

services
    .AddKiotaKeycloakAdminHttpClient(builder.Configuration, keycloakClientSectionName: adminSection)
    .AddClientCredentialsTokenHandler(adminClient);

services
    .AddKeycloakProtectionHttpClient(
        builder.Configuration,
        keycloakClientSectionName: KeycloakProtectionClientOptions.Section
    )
    .AddClientCredentialsTokenHandler(protectionClient);

Thank you

[NikiforovAll]

@savva-andreas unfortunately, it is something that is not supported at the moment. This feature is on the roadmap, but I don't have time for it right now.