Since K2, the Kladde team has signed in with Entra ID, and from exactly one directory: that of the invented IT office. Since lesson
4.3.1, every key has nevertheless carried the tenant ID, and ClaimsCurrentUser reads it from the token's tid claim (lesson 4.3.5).
So far, tid always had the same value. In this lesson that changes: the Kladde lets in people from several Entra directories,
one per office, but only from those that are enabled.
At the end of the lesson, the Kladde's sign-in is multitenant, a test with locally issued tokens proves that a foreign directory sees nothing, and the pipeline and apps sign in without a single secret.
Three kinds of identity
| Who | How the Kladde recognizes them | Since when |
|---|---|---|
| People in the office | oid (the person) together with tid (their directory), never the email address |
K2 |
| Tenants, that is, the offices | tid: an office is an Entra directory |
several from this lesson on |
| Services: web, worker, jobs, pipeline | one managed identity per app; the pipeline through a federated credential | K3 and lesson 4.8.5 |
The middle row is a decision, not a matter of course. “An office is an Entra directory” fits as long as every office has Microsoft 365. What happens with offices that have no directory of their own, and with guests, is settled in the section “Guests or directories of their own.”