Briefly about my case:

I have an application that can manage group of users (in separate db table). This application uses Duende Identity Server, and Azure/Okta SSO using OpenID.

Each group of users can have it’s own settings for SSO – schema, client id and tenant id. Settings of each group are stored in the group’s db table – not in special EF Store.

When user tries to login via SSO, and types email – system should:

1. get user and it’s group by email
2. get settings by group
3. add or configure identity provider by it’s schema, client id and tenant id.

Currently it was implemented for OpenID Connection with this flow

1. OpenID is connected by static services.AddAuthentication().AddOpenIdConnect, using common set of credemtials
2. At the same time, it is configured with OnRedirectToIdentityProvider event. Within this event all necessary logic about users was written.

This flow worked, but now I need to add SAML2 connection as well, using SAML2P library – and it doesn’t have such event, so need to do something else.

How this case with multi-tenancy should be handled? I tried to use Dynamic Providers, but cannot realize, how to add user’s email or logic to the implementation of IIdentityProviderStore interface.