In this lesson, you will learn how to configure your C# application to trust identity tokens issued by an external organization, enabling seamless B2B authentication.
Understanding Cross-Tenant Trust
When your application is part of a multi-tenant system, it usually trusts only the identity provider (IdP) belonging to your own organization. However, in B2B scenarios, you often need to grant access to users from a partner organization without requiring them to create a new account in your system.
Cross-tenant authentication allows your application to validate "guest" tokens. Instead of your app having its own directory for these external users, your identity provider establishes a federated trust relationship with the partner's IdP. When a user logs in, their home organization issues a token, and your application validates that token against the established trust policy.
Implementing Trust via Token Validation
In a standard ASP.NET Core identity setup, your TokenValidationParameters dictates which issuer is allowed to sign tokens. To support cross-tenant authentication, you must update your validation logic to accept multiple ValidIssuers.
// Inside your Authentication configuration
services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
.AddJwtBearer(options =>
{
options.TokenValidationParameters = new TokenValidationParameters
{
ValidateIssuer = true,
// Add the home tenant AND the partner tenant IDs
ValidIssuers = new[] {
"https://sts.windows.net/your-tenant-id/",
"https://sts.windows.net/partner-tenant-id/"
},
ValidateAudience = true,
ValidAudience = "your-app-client-id"
};
});
The Security Caveat
When enabling cross-tenant access, you must ensure that your Identity and Access Governance (taught in lesson 17) remains intact. Simply accepting a token from an external tenant isn't enough; you must verify the tid (tenant ID) claim within the token to ensure the user is specifically from an authorized partner tenant and not just any user from a random external organization. Always enforce Principle of Least Privilege (lesson 10) by checking these claims in your authorization handlers before granting access to specific resources.
Key Takeaway: Cross-tenant authentication shifts trust from local user management to federated identity validation, requiring you to explicitly whitelist partner issuer endpoints and verify tenant-specific claims.