Question

I am working on my second multitenant MVC application. My first did not use subdomains. Instead, it used routes with the first parameter for the tenant (clientportal ) identifier.

Route route = new Route("{clientportal}/{controller}/{action}/{id}",
                        new RouteValueDictionary(new
                        {
                            controller = "ClientPortalHome",
                            action = "Index",
                            id = UrlParameter.Optional
                    }), new PortalRouteHandler());

This time around, I need to use actual subdomains.

Client1.mysite.com
Client2.mysite.com

To accomplish this, I implemented a Subdomain route similar to this:

Is it possible to make an ASP.NET MVC route based on a subdomain?

My question is this. Where is the correct spot to handle loading my user and authenticating the request?

Application_AuthenticateRequest is fired prior to the subdomain route. This means that when AuthenticateRequest is executing, I do not know which tenant the request is intended for.

Perhaps I can load the user and authenticate the request in the subdomain route code but this smells wrong.

What am I missing here?

Answer 1

You should use a custom Authorize filter. It is fired in the very beginning of the controller process and you will have all the piece of information you need to authenticate the user in the ControllerContext.