{"action":"created","issue":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1607","labels_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1607/labels{/name}","comments_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1607/comments","events_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1607/events","html_url":"https://github.com/IdentityServer/IdentityServer3/issues/1607","id":94330877,"number":1607,"title":"Conditional IdentityProviders and Local Login options","user":{"login":"jstrawther","id":981617,"avatar_url":"https://avatars.githubusercontent.com/u/981617?v=3","gravatar_id":"","url":"https://api.github.com/users/jstrawther","html_url":"https://github.com/jstrawther","followers_url":"https://api.github.com/users/jstrawther/followers","following_url":"https://api.github.com/users/jstrawther/following{/other_user}","gists_url":"https://api.github.com/users/jstrawther/gists{/gist_id}","starred_url":"https://api.github.com/users/jstrawther/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jstrawther/subscriptions","organizations_url":"https://api.github.com/users/jstrawther/orgs","repos_url":"https://api.github.com/users/jstrawther/repos","events_url":"https://api.github.com/users/jstrawther/events{/privacy}","received_events_url":"https://api.github.com/users/jstrawther/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-07-10T15:36:41Z","updated_at":"2015-07-14T17:30:36Z","closed_at":null,"body":"I am hosting an IdentityServer3 instance that's configured for a couple of external authentication providers, and have a client web app (asp.net mvc) that uses the idSvr for authentication.  A new requirement is to differentiate between two different user types (tenants?) in the client app.  One group of users will only see the external authentication providers on the login page.  The other group of users will only see local login/password on the login page.  I'm looking for suggestions on a good approach to this.\r\n\r\nIdeas so far:  \r\n\r\nA) In the client app, serve 2 separate login controller actions, and in OpenIdConnectAuthenticationNotifications.RedirectToIdentityProvider notification, inspect the request URI and send the appropriate tenant name in the ProtocolMessage.AcrValues (\"tenant:name\") depending on which login action is used.  In IdSvr UserService.PreAuthenticateAsync method, put the tenant in the Per-Request OwinContext for easy access, and implement an IViewLoader that inspects the OwinContext and loads one of two custom login views depending on which tenant is specified.  \r\n\r\nB) Host separate IdSvrs - one for local auth and another for external auth, and (somehow?) dynamically select the OpenIdConnect Authority in the client web app based on which login route is specified.  Perhaps this could also be done in the OIDC RedirectToIdentityProvider notification.\r\n\r\nI'm curious about implications of either of these approaches, or whether there's a better one that i'm overlooking..\r\n\r\nThanks for your time."},"comment":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/comments/121316727","html_url":"https://github.com/IdentityServer/IdentityServer3/issues/1607#issuecomment-121316727","issue_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1607","id":121316727,"user":{"login":"jstrawther","id":981617,"avatar_url":"https://avatars.githubusercontent.com/u/981617?v=3","gravatar_id":"","url":"https://api.github.com/users/jstrawther","html_url":"https://github.com/jstrawther","followers_url":"https://api.github.com/users/jstrawther/followers","following_url":"https://api.github.com/users/jstrawther/following{/other_user}","gists_url":"https://api.github.com/users/jstrawther/gists{/gist_id}","starred_url":"https://api.github.com/users/jstrawther/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jstrawther/subscriptions","organizations_url":"https://api.github.com/users/jstrawther/orgs","repos_url":"https://api.github.com/users/jstrawther/repos","events_url":"https://api.github.com/users/jstrawther/events{/privacy}","received_events_url":"https://api.github.com/users/jstrawther/received_events","type":"User","site_admin":false},"created_at":"2015-07-14T17:30:36Z","updated_at":"2015-07-14T17:30:36Z","body":"I'm wondering if i'm using the right approach to switch between ClientIds.  Everything seems OK until the http request comes back to the alternate, non-default ClientId.  The user is not authenticated.  If i inspect the cookies, the nonce is still present, and there is no cookie indicating successful login. When the request comes back from the default ClientId, the user is authenticated and the cookies look good. \r\n\r\nIs there anything special that I need to do in the client app to switch clientIDs dynamically?  Here's what i've got.  \r\n\r\nNotifications = new OpenIdConnectAuthenticationNotifications \r\n                { \r\n                    RedirectToIdentityProvider = n =>\r\n                        {\r\n                            if (n.Request.Uri.ToString().Contains(\"/Login/Vendor\"))\r\n                            {\r\n                                n.Options.ClientId = ConfigurationManager.AppSettings[\"EVendorPortalClientId\"];\r\n                                n.Options.RedirectUri = ConfigurationManager.AppSettings[\"EVendorPortalRedirectUri\"];\r\n                            }\r\n                            else\r\n                            {\r\n                                n.Options.ClientId = ConfigurationManager.AppSettings[\"PortalClientId\"];\r\n                                n.Options.RedirectUri = ConfigurationManager.AppSettings[\"PortalRedirectUri\"];\r\n                            }\r\n                            n.ProtocolMessage.ClientId = n.Options.ClientId;\r\n                            n.ProtocolMessage.RedirectUri = n.Options.RedirectUri;\r\n                            return Task.FromResult(0);\r\n                        }\r\n                }\r\n\r\nThanks so much."}}