We are currently rewriting many of our internal desktop applications and converting them over to white-labeled, multi-tenant web applications. As part of the transition, we've setup a centralized identity server using IdentityServer4 in conjunction with AspNetCore Identity. As it stands now, IdentityServer makes it convenient to control access to our various applications, APIs, and resources. However, claims/roles-based endpoint security for the individual applications seems a bit more problematic.
As I understand it, I can leverage IdentityServer to manage our endpoint security, however that results in our identity server managing the security details for each application and that seems suboptimal. Another option would be to utilize AspNetCore identity directly in the individual apps, but this presents another issue with large amounts of data duplication as we'd have to provision application-level accounts every time a user authenticates with another web app.
Another potential option would be implementing our own authorization framework, but I'd like to avoid this approach if there's something else we can leverage. This application is incredibly time-sensitive, so we're really trying to figure out what would be the best option.
As far as the scope of the security goes, we're basically needing a way to both manage what tenants a user can affect as well as what level of access they have for each tenant. The tenant id is included in the request headers to the server, and since we're leveraging CQRS, implementing a pipeline behavior to manage the preauthorization of resources is rather trivial, but the actual endpoint security is a bit more cumbersome.
What is the proper approach for handling endpoint authorization when using a separate, centralized identity server?