Sub-Domain Tenant resolution in a Tiered Environment. Static Authserver domain (no sub-domain) #9504

3 Answer(s)

• 

  0

  AI-Bot created 18 days ago

  Support Team ABP Agent

  To achieve subdomain-based tenant resolution in a tiered ABP Blazor Server environment with a static AuthServer domain (no wildcard), you need to ensure that the tenant context is consistently and securely passed from the Blazor app (which uses subdomains) to the AuthServer (which does not use subdomains). Your approach is mostly correct, but there are some ABP-recommended practices and built-in features that can simplify and standardize this process.

  Solution

  1. Blazor App: Subdomain Tenant Resolution

  • Use the built-in domain/subdomain tenant resolver:

    Configure<AbpTenantResolveOptions>(options =>
    {
        options.AddDomainTenantResolver("{0}.uat.domain.io");
    });
    

  • This will resolve the tenant from the subdomain (e.g., tenant1.uat.domain.io → tenant1).

  2. AuthServer: Tenant Resolution via Query String

  Since your AuthServer is at a static domain (auth.uat.domain.io), you cannot resolve the tenant from the subdomain. The recommended approach is to pass the tenant name as a query string parameter (e.g., ?tenant=tenant1) when redirecting to the AuthServer.

  • In your Blazor app, when redirecting to the AuthServer for login, append the tenant name to the return URL:

    var tenantName = currentTenant.Name;
    var returnUrl = $"/signin-oidc?tenant={tenantName}";
    // Use this returnUrl in your OIDC configuration
    

  • On the AuthServer, use the built-in QueryStringTenantResolveContributor:

    Configure<AbpTenantResolveOptions>(options =>
    {
        options.TenantResolvers.Clear();
        options.TenantResolvers.Add(new QueryStringTenantResolveContributor());
        options.TenantResolvers.Add(new CookieTenantResolveContributor());
        options.TenantResolvers.Add(new HeaderTenantResolveContributor());
    });
    

    This will resolve the tenant from the tenant query string parameter.

  3. Ensure Consistent Tenant Context

  • Always include the tenant name in the authentication flow (as a query string) when redirecting between the Blazor app and the AuthServer.
  • If you use ABP's built-in OIDC integration, you can override the authority and redirect URIs to include the tenant parameter.

  4. CORS and Redirect URIs

  • In your IdentityServer/DbMigrator configuration, set the client RootUrl and allowed CORS origins to use the {0} placeholder:

    "RootUrl": "https://{0}.uat.domain.io"
    

  • This allows any tenant subdomain to be accepted.

  5. Example: ABP Sample

  ABP provides a sample for subdomain tenant resolution:

  • https://github.com/abpframework/abp-samples/tree/master/DomainTenantResolver

  6. Important Notes

  • Do not clear and re-order the default tenant resolvers unless you have a specific reason. Use ABP's built-in contributors where possible.
  • The tenant context must be explicitly passed from the UI to the AuthServer if the AuthServer does not use subdomains.
  • If you want to support both host and tenant logins, ensure your logic falls back to host if no tenant is resolved.

  References

  • ABP Multi-Tenancy Documentation
  • ABP DomainTenantResolver Sample
  • Community Article: Blazor Multi-Tenant Subdomain Resolution

  This approach is standard for ABP multi-tenancy in tiered environments with a static AuthServer domain.

  ---

  This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.

  Save Cancel
• 

  0

  gthompson2005 created 18 days ago

  My custom subdomain resolver excludes various subdomains such as uat, api, auth which are used for the various services as well as the uat base in this case is for the host.

  I have previously added the following to AddAbpOpenIdConnect options

  options.Events.OnRedirectToIdentityProvider = context =>
  {
      var httpContext = context.HttpContext;
      var currentTenant = httpContext.RequestServices
          .GetRequiredService<ICurrentTenant>();
  
      if (currentTenant?.Name != null)
      {
          context.ProtocolMessage.SetParameter("tenant", currentTenant.Name);
      }
      else
      {
          // On host tenant access, ensure we don't leak the last tenant
          context.ProtocolMessage.Parameters.Remove("tenant");
          context.HttpContext.Response.Cookies.Delete("Abp.TenantId");
      }
  
      return Task.CompletedTask;
  };
  

  Save Cancel
• 

  0

  maliming created 13 days ago

  Support Team Fullstack Developer

  hi

  I guess your blazor app is Blazor Server.

  1. You should add CurrentUserTenantResolveContributor in all projects.

  options.TenantResolvers.Insert(0, new CurrentUserTenantResolveContributor());

  2.

  What I expect to Happen: User visits tenant.uat.domain.io Application validates Tenant on Blazor app and directs to Account/Login on Auth Server Auth Server validates Tenant without using subdomain (limiting this to just point to auth.uat.domain.io) If no Subdomain or tenant resolved assume host If tenant resolved on blazor side from subdomain, then use that tenant for logging in as well via querystring or other methods of sharing.

  2.1 Does your tenant work on a Blazor project?

  2.2

  directs to Account/Login on Auth Server

  Auth Server can't know your current tenant of Blazor, which means you need to pass tenant info to Auth Server. eg: auth.uat.domain.io?__tenant=tenant1

  3. Once you log in to the Auth Server. The current tenant of AuthServer will not change. because of CurrentUserTenantResolveContributor

  Thanks.

  Save Cancel