0

At the moment I'm working with ASP.NET MVC 5 and the new Identity 2 framework for authentication and authorization. Based on these principals I implemented a custom claim-based system which is able to check if a user action is permitted by passing an area and an action (e.g area is reservation and the action is create).

Now I have the requirement to extend the system for using it in a multi-tenant application which differentiate the tenants by a url sub path. (e.g. https://www.mydomain.com/tenant1/{controller}/{action}.

The Identity framework is imho not able to set cookies based on a specific url sub path. On every place I tried to hook in and set the cookie path failed.

The second use case I have, is granting a user temporary for a set of actions without the need to logout afterwards. This should also work if cookies are disabled.

I decided to rewrite the authentication system from scratch to fulfill my needs. Whats the best way to implement a cookie less temporary login. Story: User wants to place a reservation. Therefore he must be authenticated to navigate through a wizard (2 or 3 async server requests). After finishing the wizard the user must be logged out without any interaction. Created tokens must be invalidated (used for a kiosk mode).

What kind of principles and best practices exists for this scenario? And experience with a similar use case?

dannyyy
  • 1,784
  • 2
  • 19
  • 43
  • The only way you can possibly do it is with something in the URL because MVC is stateless. Well, you could probably do some hacky stuff that will work poorly with session, but I wouldn't. – Casey Apr 10 '15 at 04:29
  • As far as Identity with a multi-tenant application, the way I did it was put a claim in for the tenant, and then added a new attribute that inherited from the AuthorizeAttribute and, in addition to the base claim, checked the database to ensure the login cookie was for the current tenant. – Casey Apr 10 '15 at 04:31
  • I guess you probably solved this problem at some point between a year ago and now, though. – Casey Apr 10 '15 at 04:31

1 Answers1

1

Look at the MembershipReboot project. It supports multi-tenant mode out of the box. MembershipReboot

Writing your custom authentication framework is last thing you should do, unless it is your primary business.

Alex Michel
  • 416
  • 3
  • 13