Create Tenant and User in one call

[Phil91]

Good evening guys, hope that question isn't silly.

My current workflow to setup a tenant / sign up the initial user is wrapped in two api calls.

1. tenant is created and returns the tenantId
2. the tenantId is set into the request header and the user signUp call is executed.

Works fine so far. The configuration is down below.

.AddMultiTenant<TenantInfo>()
    .WithClaimStrategy(ClaimConstants.Tenant)
    .WithHeaderStrategy(Constants.TenantIdName)
    .WithQueryStringStrategy(Constants.TenantIdName)
    .WithEFCoreStore<TenantDbContext, TenantInfo>()

Now i would like to add the following scenarios, which is currently running into errors.

I'd like to only send one request, create the tenant and then create the user right after. I tryed to set the tenantInfo after creating the tenant with:

_httpContextAccessor.HttpContext!.TrySetTenantInfo(newTenantInfo, true)

but i'll receive an error from the userManager when trying to create the user:

System.NullReferenceException: Object reference not set to an instance of an object.
   at lambda_method468(Closure , QueryContext )
   at Microsoft.EntityFrameworkCore.Query.Internal.QueryCompiler.ExecuteAsync[TResult](Expression query, CancellationToken cancellationToken)
   at Microsoft.EntityFrameworkCore.Query.Internal.EntityQueryProvider.ExecuteAsync[TResult](Expression expression, CancellationToken cancellationToken)
   at Microsoft.EntityFrameworkCore.EntityFrameworkQueryableExtensions.ExecuteAsync[TSource,TResult](MethodInfo operatorMethodInfo, IQueryable`1 source, Expression expression, CancellationToken cancellationToken)
   at Microsoft.EntityFrameworkCore.EntityFrameworkQueryableExtensions.ExecuteAsync[TSource,TResult](MethodInfo operatorMethodInfo, IQueryable`1 source, LambdaExpression expression, CancellationToken cancellationToken)
   at Microsoft.EntityFrameworkCore.EntityFrameworkQueryableExtensions.FirstOrDefaultAsync[TSource](IQueryable`1 source, Expression`1 predicate, CancellationToken cancellationToken)
   at Microsoft.AspNetCore.Identity.EntityFrameworkCore.UserStore`9.FindByNameAsync(String normalizedUserName, CancellationToken cancellationToken)
   at Microsoft.AspNetCore.Identity.UserManager`1.FindByNameAsync(String userName)
   at Microsoft.AspNetCore.Identity.UserValidator`1.ValidateUserName(UserManager`1 manager, TUser user, ICollection`1 errors)
   at Microsoft.AspNetCore.Identity.UserValidator`1.ValidateAsync(UserManager`1 manager, TUser user)
   at Microsoft.AspNetCore.Identity.UserManager`1.ValidateUserAsync(TUser user)
   at Microsoft.AspNetCore.Identity.UserManager`1.CreateAsync(TUser user)
   at Microsoft.AspNetCore.Identity.UserManager`1.CreateAsync(TUser user, String password)

I guess thats related to the TenantInfo which is somehow not set ccorrectly? when trying the exact request with e.g. the header value set, everything is working fine.

If so could help it would be much appreciated

[AndrewTriesToCode]

No it's not a silly question. I'm working on some functionality that will help in this common use case, but in the mean time I'll post some code here that will help you later tonight.

[AndrewTriesToCode]

One more thing. Can you describe your user flow? Sounds like they sign up, a new tenant is created for them, then you add them as a user in their new tenant. Do I have that right?

Also is the user manager you get the error from brought in via DI? If that's the case it has the nonexistent or prior tenant baked in. You would want to retrieve a new one from 'HttpContext.RequestServices' after you reset DI scope via 'TrySetTenantInfo'. Does that make sense?

[AndrewTriesToCode]

So I went to grab some code and I realized it simply did what I describe above. Any luck with that?

[Phil91]

Yes you got that right. The userManager is currently used via DI.
I will try it out and let you know (:

Thanks for your help in advance.

[Phil91]

That did the trick. thanks a lot :)

[NickBuckland]

Sorry if I am hijacking this post but seemed to make sense rather than start a new thread on the same topic.

1. I wonder if @AndrewTriesToCode you have made any progress on this feature?
2. Using the comments above I have adapted the Identity/Account/Register page and I am able to

• create a new user
• create a new tenant
  however following the normal workflow, the redirect to RegisterConfirmation page fails as the UserManager (from DI) is unaware of the new TenantInfo
  Unless you have better idea, I need some method of updating the application UserManager service with TenantInfo so that it is avaiable on subsequent calls.

Thanks Nick

[AndrewTriesToCode]

Nothing at the moment. I intend to implement some extension factory methods for things like UserManager that will create a new instance with for given tenant rather than the "current" tenant. This requires instantiating a UserManager with the correct underlying UserStore and underlying dbcontext for the given tenant, each of which I also want to create factory methods for.

Stay tuned! I've been busy with regular life lately but will be coming back to this.

[NickBuckland]

Yes I understand about life getting in the way :)
With your prompts I have been wrestling with creating factories for DbContext & SignInManager etc. All seemed to be working until I tried to use _signInManager.IsSignedIn(User); to check that I had a valid logged in user.

A long story short, I managed to figure the problem out but want your feedback.
Forgot to say I am using WithClaimStrategy()

The problems is a mismatch when reading/writing to the cookie.
You set the tenant data in AuthenticationProperties in MultiTenantAuthenticationService using this method AddTenantIdentifierToProperties(context, ref properties);

However the ClaimsStrategy is trying to read from the Claims collection.

To test this theory I have added the tenant data to a new claim, and I now get an authenticated user for a given tenant.

So my question is, should I modify the methods in MultiTenantAuthenticationService to set the tenant claim and remove AddTenantIdentifierToProperties or will this have further ramifications?

Minor update: I have found that I need keep that call to AddTenantIdentifierToProperties in addition to adding to the claims otherwise authentication does not work correctly (I have yet to figure out why)

BTW If/when I get this working I plan to raise a PR for you to use.
Thanks Nick

[j-vinnal]

I'm writing my thesis on .NET Multi-tenant architecture and currently implementing a similar flow for creating tenant and admin user.
It would be good if the admin user could receive a JWT token after registration.

Using hybrid tenant isolation model.

Does anyone have a good example or description of how they have implemented this?