{"id":2518,"date":"2013-10-26T00:27:33","date_gmt":"2013-10-26T07:27:33","guid":{"rendered":"http:\/\/www.cloudidentity.com\/blog\/?p=2518"},"modified":"2013-10-26T01:01:51","modified_gmt":"2013-10-26T08:01:51","slug":"you-have-to-sign-up-with-your-own-multiple-organizations-asp-net-app-before-you-can-sign-in","status":"publish","type":"post","link":"https:\/\/www.cloudidentity.com\/blog\/2013\/10\/26\/you-have-to-sign-up-with-your-own-multiple-organizations-asp-net-app-before-you-can-sign-in\/","title":{"rendered":"You Have to Sign Up With Your Own Multiple Organizations ASP.NET App Before You Can Sign In"},"content":{"rendered":"

Well, I\u2019ve basically wrote most of the post already in the extra-long title! \"Smile\"<\/p>\n

The ASP.NET project templates in VS2013 for multiple organizations apps contain a design choice which appears to be causing grief to many developers. In this post I am going to describe the issue (and show you how to make it a non-issue) \u2013 for the longer term I guess that the default behavior might have to be changed \"Smile\"<\/p>\n

The Issue<\/h2>\n

The issue is easily explained. If you follow this blog, you already know that the ASP.NET project creation in VS2013 offers you the chance of configuring projects for various authentication styles for business apps.
One of the available templates generates one application meant to be consumed by multiple organizations: if you like buzzwords, that\u2019s what you\u2019d call a SaaS app or a multi-tenant app.<\/p>\n

Those apps are meant to accept users from multiple organizations, and more precisely from multiple Windows Azure AD tenants. The template code contains logic for onboarding new organizations: it boils down to triggering the consent flow which allows a the admin of a prospective customer to instantly grant to the application access to his\/her own tenant. The application template provides a database which is used to maintain the list of organizations that have been onboarded; such database is used at sign in time to establish if the incoming user belongs to one of the onboarded tenants. The template contains logic for processing messages about successful onboardings by adding the corresponding organization in the database.<\/p>\n

\"image\"<\/a><\/p>\n

Here there\u2019s the thing that is causing the issue for some of you: at creation time, that database is empty<\/em>. <\/p>\n

Technically, when you create a multiple organizations app entry in Windows Azure AD you are doing two operations at once: creating the Application object which describes the app, and consenting for that app to use your directory (e.g. creating a service principal for it in your directory). For a deep dive on the application model, see here<\/a>.
However, the VS template does NOT reflect the fact that your app is automatically provisioned in your own tenant. There is a reason for that: your application might call for some extra provisioning operations every time you onboard a new customer organization, and pre-provisioning a tenant in the DB would create an odd situation as your extra provisioning logic would have never a chance to run. <\/p>\n

Regardless of the reason, this creates a problem for the ones among you who follow this rather natural sequence:<\/p>\n