I am currently developing a multi-user Angular SPA application that connects to multiple webAPIs in the backend and uses AzureAD authentication, where each AD represents a tenant.
The Azure documentation for multi-level points, for example applicaiton, is called Tailpsin.Surveys , which I was able to run after completing the steps on the page. This application is different from my scenario, as it is WebApp no a SPA.
In this webApp, during the installation of OpenID Middlreware, the implementation is executed OpenIdConnectEvents. This implementation overrides the method TokenValidatedand blocks tenants who have not previously registered.
What I'm trying to achieve in my application, but does this mean that every WebAPI should always check the issuer's application for a token in order to check the tenant?
It seems like something is repeating itself and could be a performance issue, I believe.
Is there any configuration in Azure or any other ways to restrict access to your application to a set of specific tenants?
source
share