<PackageReference Include="Finbuckle.MultiTenant.AspNetCore" Version="6.7.3" />
    <PackageReference Include="Finbuckle.MultiTenant.EntityFrameworkCore" Version="6.7.3" />
    <PackageReference Include="Microsoft.AspNetCore.Diagnostics.EntityFrameworkCore" Version="6.0.7" />
    <PackageReference Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" Version="6.0.7" />
    <PackageReference Include="Microsoft.AspNetCore.Identity.UI" Version="6.0.7" />
    <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="6.0.7" />
    <PackageReference Include="Microsoft.EntityFrameworkCore.Tools" Version="6.0.7">
      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
      <PrivateAssets>all</PrivateAssets>
    </PackageReference>
    <PackageReference Include="OpenIddict" Version="3.1.1" />
    <PackageReference Include="OpenIddict.AspNetCore" Version="3.1.1" />
    <PackageReference Include="OpenIddict.EntityFrameworkCore" Version="3.1.1" />

using Finbuckle.MultiTenant;

namespace MultiTenants.IdentityServer.Domain.Entities.TenantAdmin;

public class MultiTenantInfo : ITenantInfo
{
    public string Id { get; set; }
    public string Identifier { get; set; }
    public string Name { get; set; }
    public string ConnectionString { get; set; }
}

using Finbuckle.MultiTenant.Stores;
using Microsoft.EntityFrameworkCore;
using MultiTenants.IdentityServer.Domain.Entities.TenantAdmin;

namespace MultiTenants.IdentityServer.Persistence;


public class TenantAdminDbContext : EFCoreStoreDbContext<MultiTenantInfo>
{
    public TenantAdminDbContext(DbContextOptions<TenantAdminDbContext> options)
        : base(options)
    {

    }
}

using Finbuckle.MultiTenant;
using Microsoft.AspNetCore.Identity.EntityFrameworkCore;
using Microsoft.EntityFrameworkCore;
using MultiTenants.IdentityServer.Domain.Entities.TenantAdmin;

namespace MultiTenants.IdentityServer.Persistence;

public class IdentityServerDbContext : IdentityDbContext
{
    private readonly MultiTenantInfo _tenant;
    private readonly IWebHostEnvironment _env;
    private readonly IConfiguration _config;

    public IdentityServerDbContext(
        DbContextOptions<IdentityServerDbContext> options,
        IMultiTenantContextAccessor<MultiTenantInfo> accessor,
        IWebHostEnvironment env,
        IConfiguration config) : base(options)
    {
        _tenant = accessor.MultiTenantContext?.TenantInfo;
        _env = env;
        _config = config;
    }


    protected override void OnConfiguring(DbContextOptionsBuilder optionsBuilder)
    {
        string connectionString;

        if (_tenant is null && _env.IsDevelopment())
        {
            // Si no hay tenant y estamos en desarrollo, es un comando <dotnet ef>
            connectionString = _config.GetConnectionString("DefaultConnection");
        }
        else
        {
            // Tenant connection string
            connectionString = _tenant.ConnectionString;
        }

        optionsBuilder.UseSqlServer(connectionString);
        optionsBuilder.UseOpenIddict();


        base.OnConfiguring(optionsBuilder);
    }
}

using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Identity;
using Microsoft.EntityFrameworkCore;
using MultiTenants.IdentityServer.Domain.Entities.TenantAdmin;
using MultiTenants.IdentityServer.Persistence;

namespace MultiTenants.IdentityServer;
public static class DependencyConfig
{
    public static IServiceCollection AddAspNetServices(this IServiceCollection services)
    {

        services.AddRazorPages();
        services.AddControllers();
        services.AddDatabaseDeveloperPageExceptionFilter();

        return services;
    }

    public static IServiceCollection AddMultiTenantSupport(this IServiceCollection services)
    {
        services.AddMultiTenant<MultiTenantInfo>()
            .WithHostStrategy()
            .WithEFCoreStore<TenantAdminDbContext, MultiTenantInfo>()
            .WithPerTenantAuthentication()
            .WithPerTenantOptions<CookieAuthenticationOptions>((o, tenant) =>
            {
                o.Cookie.Name = $".Identity_{tenant.Identifier}";
                o.LoginPath = "/Identity/Account/Login";
            });

        return services;
    }

    public static IServiceCollection AddIdentity(this IServiceCollection services)
    {
        services.AddDefaultIdentity<IdentityUser>(options =>
        {
            // Password settings.
            options.Password.RequireDigit = false;
            options.Password.RequireLowercase = false;
            options.Password.RequireNonAlphanumeric = false;
            options.Password.RequireUppercase = false;
            options.Password.RequiredLength = 6;
            options.Password.RequiredUniqueChars = 1;

            // User settings.
            options.User.RequireUniqueEmail = true;
            options.SignIn.RequireConfirmedEmail = false;

        }).AddEntityFrameworkStores<IdentityServerDbContext>();

        return services;
    }

    public static IServiceCollection AddDbContexts(this IServiceCollection services, IConfiguration config)
    {
        services.AddDbContext<TenantAdminDbContext>(options =>
            options.UseSqlServer(config.GetConnectionString("TenantAdmin")));
        services.AddDbContext<IdentityServerDbContext>();

        return services;
    }

    public static IServiceCollection AddOpenIdConnect(this IServiceCollection services)
    {
        services.AddOpenIddict()

            // Register the OpenIddict core components.
            .AddCore(options =>
            {
                // Configure OpenIddict to use the EF Core stores/models.
                options
                    .UseEntityFrameworkCore()
                    .UseDbContext<IdentityServerDbContext>();
            })
            // Register the OpenIddict server components.
            .AddServer(options =>
            {
                options
                    .AllowAuthorizationCodeFlow()
                    .RequireProofKeyForCodeExchange()
                    .AllowRefreshTokenFlow();

                options
                    .SetTokenEndpointUris("/connect/token")
                    .SetAuthorizationEndpointUris("/connect/authorize")
                    .SetUserinfoEndpointUris("/connect/userinfo")
                    .SetLogoutEndpointUris("/connect/logout");

                // Encryption and signing of tokens
                options
                    .AddEphemeralEncryptionKey()
                    .AddEphemeralSigningKey()
                    .DisableAccessTokenEncryption();

                // Register scopes (permissions)
                options.RegisterScopes("api");
                options.RegisterScopes("profile");

                // Register the ASP.NET Core host and configure the ASP.NET Core-specific options.
                options
                    .UseAspNetCore()
                    .EnableTokenEndpointPassthrough()
                    .EnableAuthorizationEndpointPassthrough()
                    .EnableUserinfoEndpointPassthrough()
                    .EnableLogoutEndpointPassthrough();
            });

        return services;
    }
}

using Finbuckle.MultiTenant;
using MultiTenants.IdentityServer;
using MultiTenants.IdentityServer.Domain.Entities.TenantAdmin;
using MultiTenants.IdentityServer.Persistence;
using OpenIddict.Abstractions;

var builder = WebApplication.CreateBuilder(args);

builder.Services
    .AddDbContexts(builder.Configuration)
    .AddIdentity()
    .AddOpenIdConnect()
    .AddMultiTenantSupport()
    .AddAspNetServices();

var app = builder.Build();

// Configure the HTTP request pipeline.
if (app.Environment.IsDevelopment())
{
    app.UseMigrationsEndPoint();
}
else
{
    app.UseExceptionHandler("/Error");
    app.UseHsts();
}

app.UseHttpsRedirection();
app.UseStaticFiles();
app.UseRouting();
app.UseMultiTenant();
app.UseAuthentication();
app.UseAuthorization();
app.MapRazorPages();
app.MapControllers();

app.Run();

{
  "version": "1.0",
  "defaultProvider": "cdnjs",
  "libraries": [
    {
      "provider": "cdnjs",
      "library": "bootstrap@5.2.0",
      "destination": "wwwroot/lib/bootstrap/"
    },
    {
      "provider": "cdnjs",
      "library": "jquery@3.6.0",
      "destination": "wwwroot/lib/jquery/"
    },
    {
      "provider": "cdnjs",
      "library": "jquery-validate@1.19.5",
      "destination": "wwwroot/lib/jquery-validate/",
      "files": [
        "additional-methods.js",
        "additional-methods.min.js",
        "jquery-validation-sri.json",
        "jquery.validate.js",
        "jquery.validate.min.js"
      ]
    },
    {
      "provider": "cdnjs",
      "library": "jquery-validation-unobtrusive@4.0.0",
      "destination": "wwwroot/lib/jquery-validation-unobtrusive/"
    }
  ]
}

@{
    Layout = "/Pages/Shared/_Layout.cshtml";
}

@using Finbuckle.MultiTenant
@using MultiTenants.IdentityServer.Domain.Entities.TenantAdmin
@inject IMultiTenantContextAccessor<MultiTenantInfo> Tenant

@{
    var tenantName = Tenant.MultiTenantContext?.TenantInfo?.Name ?? "no-tenant";
    var identifier = Tenant.MultiTenantContext?.TenantInfo?.Identifier ?? "no-tenant";
}

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="utf-8" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    <title>@ViewData["Title"] - @tenantName</title>
    <link rel="stylesheet" href="~/lib/bootstrap/css/bootstrap.min.css" />
    <link rel="stylesheet" href="~/css/site.css" asp-append-version="true" />
    <link rel="stylesheet" href="~/MultiTenants.IdentityServer.styles.css" asp-append-version="true" />
</head>
<body>
    <header>
        <nav class="navbar navbar-expand-sm navbar-toggleable-sm navbar-light bg-white border-bottom box-shadow mb-3">
            <div class="container">
                <a class="navbar-brand" asp-area="" asp-page="/Index">Identity - @tenantName</a>
                <button class="navbar-toggler" type="button" data-bs-toggle="collapse" data-bs-target=".navbar-collapse" aria-controls="navbarSupportedContent"
                        aria-expanded="false" aria-label="Toggle navigation">
                    <span class="navbar-toggler-icon"></span>
                </button>
                <div class="navbar-collapse collapse d-sm-inline-flex justify-content-between">
                    <ul class="navbar-nav flex-grow-1">
                        <li class="nav-item">
                            <a class="nav-link text-dark" asp-area="" asp-page="/Index">Home</a>
                        </li>
                    </ul>
                    <partial name="_LoginPartial" />
                </div>
            </div>
        </nav>
    </header>
    <div class="container">
        <main role="main" class="pb-3">
            @RenderBody()
        </main>
    </div>

    <footer class="border-top footer text-muted">
        <div class="container">
            &copy; 2022 - MultiTenants.IdentityServer - <a asp-area="" asp-page="/Privacy">Privacy</a>
        </div>
    </footer>

    <script src="~/lib/jquery/jquery.min.js"></script>
    <script src="~/lib/bootstrap/js/bootstrap.bundle.min.js"></script>
    <script src="~/js/site.js" asp-append-version="true"></script>

    @await RenderSectionAsync("Scripts", required: false)
</body>
</html>

@page
@model IndexModel
@{
    ViewData["Title"] = "Home page";
}

<div class="text-center">
    @if(User.Identity.IsAuthenticated)
    {
        <h1 class="display-4">Welcome, @User.Identity.Name</h1>
        <ul>
            @foreach(var claim in User.Claims)
            {
                <li>@claim.Type: @claim.Value</li>
            }
        </ul>
    }
    else
    {
        <p>Sign in please</p>
    }
</div>

@using Finbuckle.MultiTenant
@using Microsoft.AspNetCore.Identity
@using MultiTenants.IdentityServer.Domain.Entities.TenantAdmin

@inject SignInManager<IdentityUser> SignInManager
@inject UserManager<IdentityUser> UserManager
@inject IMultiTenantContextAccessor<MultiTenantInfo> Tenant

@{
    var identifier = Tenant.MultiTenantContext?.TenantInfo?.Identifier ?? "no-tenant";
}

<ul class="navbar-nav">
@if (SignInManager.IsSignedIn(User))
{
    <li class="nav-item">
        <a  class="nav-link text-dark" asp-area="Identity" asp-page="/Account/Manage/Index" title="Manage">Hello @User.Identity?.Name!</a>
    </li>
    <li class="nav-item">
            <form class="form-inline" asp-area="Identity" asp-page="/Account/Logout" asp-route-returnUrl="@Url.Page("/", new { area = "" })" method="post">
            <button  type="submit" class="nav-link btn btn-link text-dark">Logout</button>
        </form>
    </li>
}
else
{
    <li class="nav-item">
        <a class="nav-link text-dark"
            asp-area="Identity"
            asp-page="/Account/Register">Register</a>
    </li>
    <li class="nav-item">
        <a class="nav-link text-dark"
            asp-area="Identity"
            asp-page="/Account/Login">Login</a>
    </li>
}
</ul>

dotnet ef migrations add FirstMigration --context IdentityServerDbContext -o Persistence/Migrations/IdentityServer
dotnet ef database update --context IdentityServerDbContext

dotnet ef migrations add TenantsFirstMigration --context TenantAdminDbContext -o Persistence/Migrations/TenantAdmin
dotnet ef database update --context TenantAdminDbContext

using Finbuckle.MultiTenant;
using MultiTenants.IdentityServer;
using MultiTenants.IdentityServer.Domain.Entities.TenantAdmin;
using MultiTenants.IdentityServer.Persistence;
using OpenIddict.Abstractions;

// ... código omitido

await SeedDefaultClients();
await SetupTenants();

app.Run();


// OpenIddict info
async Task SeedDefaultClients()
{
    using var scope = app.Services.CreateScope();

    var context = scope.ServiceProvider.GetRequiredService<IdentityServerDbContext>();
    var manager = scope.ServiceProvider.GetRequiredService<IOpenIddictApplicationManager>();

    await context.Database.EnsureCreatedAsync();

    var client = await manager.FindByClientIdAsync("tenant01");

    if (client is null)
    {
        await manager.CreateAsync(new OpenIddictApplicationDescriptor
        {
            ClientId = "tenant01",
            ClientSecret = "tenant01-web-app-secret",
            DisplayName = "Multi-Tenant Web Application 01",
            RedirectUris = { new Uri("https://localhost:xxxx/signin-oidc") },
            PostLogoutRedirectUris = { new Uri("https://localhost:xxxx/signout-callback-oidc") },
            Permissions =
            {
                OpenIddictConstants.Permissions.Endpoints.Authorization,
                OpenIddictConstants.Permissions.Endpoints.Token,

                OpenIddictConstants.Permissions.GrantTypes.AuthorizationCode,
                OpenIddictConstants.Permissions.GrantTypes.ClientCredentials,
                OpenIddictConstants.Permissions.GrantTypes.RefreshToken,
                OpenIddictConstants.Permissions.Endpoints.Logout,


                OpenIddictConstants.Permissions.Prefixes.Scope + "api",
                OpenIddictConstants.Permissions.Prefixes.Scope + "profile",
                OpenIddictConstants.Permissions.ResponseTypes.Code
            }
        });

        await manager.CreateAsync(new OpenIddictApplicationDescriptor
        {
            ClientId = "tenant02",
            ClientSecret = "tenant02-web-app-secret",
            DisplayName = "Multi-Tenant Web Application 02",
            RedirectUris = { new Uri("https://tenant2.localhost:xxxx/signin-oidc") },
            PostLogoutRedirectUris = { new Uri("https://tenant2.localhost:xxxx/signout-callback-oidc") },
            Permissions =
            {
                OpenIddictConstants.Permissions.Endpoints.Authorization,
                OpenIddictConstants.Permissions.Endpoints.Token,

                OpenIddictConstants.Permissions.GrantTypes.AuthorizationCode,
                OpenIddictConstants.Permissions.GrantTypes.ClientCredentials,
                OpenIddictConstants.Permissions.GrantTypes.RefreshToken,
                OpenIddictConstants.Permissions.Endpoints.Logout,

                OpenIddictConstants.Permissions.Prefixes.Scope + "api",
                OpenIddictConstants.Permissions.Prefixes.Scope + "profile",
                OpenIddictConstants.Permissions.ResponseTypes.Code
            }
        });
    }
}

// Multitenant info
async Task SetupTenants()
{
    using var scope = app.Services.CreateScope();

    var store = scope.ServiceProvider.GetRequiredService<IMultiTenantStore<MultiTenantInfo>>();

    var tenants = await store.GetAllAsync();

    if (tenants.Count() > 0)
    {
        return;
    }

    await store.TryAddAsync(new MultiTenantInfo
    {
        Id = Guid.NewGuid().ToString(),
        Identifier = "localhost",
        Name = "My Identity Dev Tenant",
        ConnectionString = "Server=(localdb)\\mssqllocaldb;Database=MultiTenants.IdentityServer01;Trusted_Connection=True;MultipleActiveResultSets=true"
    });

    await store.TryAddAsync(new MultiTenantInfo
    {
        Id = Guid.NewGuid().ToString(),
        Identifier = "tenant2",
        Name = "My Identity Dev Tenant 2",
        ConnectionString = "Server=(localdb)\\mssqllocaldb;Database=MultiTenants.IdentityServer02;Trusted_Connection=True;MultipleActiveResultSets=true"
    });
}

using Microsoft.AspNetCore;
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Identity;
using Microsoft.AspNetCore.Mvc;
using OpenIddict.Abstractions;
using OpenIddict.Server.AspNetCore;
using System.Security.Claims;

namespace MultiTenants.IdentityServer.Controllers;

public class AuthorizationController : ControllerBase
{
    [HttpGet("~/connect/authorize")]
    [HttpPost("~/connect/authorize")]
    [IgnoreAntiforgeryToken]
    public async Task<IActionResult> Authorize()
    {
        // Validamos que se trate de una solicitud válida de OIDC
        var request = HttpContext.GetOpenIddictServerRequest() ??
              throw new InvalidOperationException("The OpenID Connect request cannot be retrieved.");

        // Verificamos si actualmente el usuario ya está autenticado
        var result = await HttpContext.AuthenticateAsync(IdentityConstants.ApplicationScheme);

        // Si no hay información de autenticación en la Cookie, lo redireccionamos al Path
        // de inicio de sesión según el esquema configurado (/Identity/Account/Login)
        if (!result.Succeeded)
        {
            return Challenge(
                authenticationSchemes: IdentityConstants.ApplicationScheme,
                properties: new AuthenticationProperties
                {
                    RedirectUri = Request.PathBase + Request.Path + QueryString.Create(
                        Request.HasFormContentType ? Request.Form.ToList() : Request.Query.ToList())
                });
        }

        // Si llegamos hasta aquí, el usuario está autenticado
        // creamos los claims que necesitemos
        var claims = new List<Claim>
            {
                // 'subject' claim which is required
                new Claim(OpenIddictConstants.Claims.Subject, result.Principal.Identity.Name),
                new Claim(OpenIddictConstants.Claims.Username, result.Principal.Identity.Name),
                new Claim(OpenIddictConstants.Claims.Audience, "IdentityServerWebClients"), // TODO: Hacer esto dinámico.
            };

        var email = result.Principal.Claims.FirstOrDefault(q => q.Type == ClaimTypes.Email);
        if (email is not null)
        {
            claims.Add(new Claim(OpenIddictConstants.Claims.Email, email.Value));
        }


        var claimsIdentity = new ClaimsIdentity(claims, OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);
        var claimsPrincipal = new ClaimsPrincipal(claimsIdentity);

        // Al agregar claims al User Principal, tenemos que especificar si se va al ID Token o Access Token
        foreach (var claim in claimsPrincipal.Claims)
        {
            claim.SetDestinations(claim.Type switch
            {
                // Si se dió permiso del scope "profile" agregamos el claim "name" a los dos Json Web Tokens
                OpenIddictConstants.Claims.Name when claimsPrincipal.HasScope(OpenIddictConstants.Scopes.Profile) => new[]
                {
                    OpenIddictConstants.Destinations.AccessToken,
                    OpenIddictConstants.Destinations.IdentityToken
                },

                // Nunca agreguemos "secret_value" a ningún token, ya que estos no van encriptados
                // En los autorization codes si van encriptados, pero en los JWTs no.
                "secret_value" => Array.Empty<string>(),

                // Cualquier otro claim, lo agregamos al Access Token
                _ => new[]
                {
                    OpenIddictConstants.Destinations.AccessToken
                }
            });
        }

        // Ejecutar el SignIn con el esquema de OpenIddict, disparará la generación del Autorization Code.
        // Con este Autorization code podemos obtener más adelante los JSON Web Tokens (Identity y Access).
        return SignIn(claimsPrincipal, OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);
    }

    [HttpPost("~/connect/token")]
    public async Task<IActionResult> Exchange()
    {
        var request = HttpContext.GetOpenIddictServerRequest() ??
                      throw new InvalidOperationException("The OpenID Connect request cannot be retrieved.");

        ClaimsPrincipal claimsPrincipal;

        if (request.IsAuthorizationCodeGrantType())
        {
            // Retrieve the claims principal stored in the authorization code
            claimsPrincipal = (await HttpContext.AuthenticateAsync(OpenIddictServerAspNetCoreDefaults.AuthenticationScheme)).Principal;
        }
        else if (request.IsRefreshTokenGrantType())
        {
            // Retrieve the claims principal stored in the refresh token.
            claimsPrincipal = (await HttpContext.AuthenticateAsync(OpenIddictServerAspNetCoreDefaults.AuthenticationScheme)).Principal;
        }
        else
        {
            throw new InvalidOperationException("The specified grant type is not supported.");
        }

        // Returning a SignInResult will ask OpenIddict to issue the appropriate access/identity tokens.
        return SignIn(claimsPrincipal, OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);
    }

    [Authorize(AuthenticationSchemes = OpenIddictServerAspNetCoreDefaults.AuthenticationScheme)]
    [HttpGet("~/connect/userinfo")]
    public async Task<IActionResult> Userinfo()
    {
        var claimsPrincipal = (await HttpContext.AuthenticateAsync(OpenIddictServerAspNetCoreDefaults.AuthenticationScheme)).Principal;

        return Ok(new
        {
            Sub = claimsPrincipal.GetClaim(OpenIddictConstants.Claims.Subject),
            Name = claimsPrincipal.GetClaim(OpenIddictConstants.Claims.Subject),
            Occupation = "Developer",
            Age = 31
        });
    }

    [HttpPost("~/connect/logout")]
    [HttpGet("~/connect/logout")]
    [IgnoreAntiforgeryToken]
    public async Task<IActionResult> Logout([FromServices] SignInManager<IdentityUser> signInManager)
    {
        // Ask ASP.NET Core Identity to delete the local and external cookies created
        // when the user agent is redirected from the external identity provider
        // after a successful authentication flow (e.g Google or Facebook).
        await signInManager.SignOutAsync();

        // Returning a SignOutResult will ask OpenIddict to redirect the user agent
        // to the post_logout_redirect_uri specified by the client application or to
        // the RedirectUri specified in the authentication properties if none was set.
        return SignOut(
            authenticationSchemes: OpenIddictServerAspNetCoreDefaults.AuthenticationScheme,
            properties: new AuthenticationProperties
            {
                RedirectUri = "/"
            });
    }
}