title: Configuring asp.net core identity oauth2 authentication with user provided oauth2 credentials
body: <p>I build an application that extends the gitlab user experience and admins of an organization (Organizations are the tenants in the system) can configure their gitlab installation (register an OAuth2 application in their gitlab instance) and normal users in an organization can just authenticate themselves with their gitlab account via OAuth2. </p>
  
  <p>My problem at the moment is, the credentials (oauth2 client id and client secret, as well as the base url) are provided by the organization admin and are stored in the database. I want to give every organization its own subdomain and the Sign In with Gitlab button should redirect the user to their gitlab instance and follow the usual oauth2 flow for authentication, but I can't figure out how to configure the asp.net core identity framework to decide on the fly (based on the subdomain) which credentials to use for the oauth2 flow. All tutorials and microsoft provided documentations assume that you only have one "hard coded" oauth2 provided (usually configured in the ConfigureServices method of the Startup class).</p>
  
  <p>My current implementation follows the microsoft provided documentation and looks like this:</p>
  
  <pre class="lang-cs prettyprint-override"><code>public void ConfigureServices(IServiceCollection services) 
  {      
    // ... 
    services.AddAuthentication(options =&gt;
    {
      options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
      options.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
      options.DefaultChallengeScheme = "Gitlab";
    }).AddCookie()
      .AddOAuth("Gitlab", options =&gt;
      {
        options.ClientId = Configuration["Gitlab:ClientId"];
        options.ClientSecret = Configuration["Gitlab:ClientSecret"];
        options.CallbackPath = new Microsoft.AspNetCore.Http.PathString("/signin-gitlab");
  
        options.AuthorizationEndpoint = Configuration["Gitlab:BaseUrl"] + "/oauth/authorize";
        options.TokenEndpoint = Configuration["Gitlab:BaseUrl"] + "/oauth/token";
  
        options.UserInformationEndpoint = Configuration["Gitlab:BaseUrl"] + "/api/v4/user";
        options.ClaimActions.MapJsonKey(ClaimTypes.NameIdentifier, "id");
        options.ClaimActions.MapJsonKey(ClaimTypes.Name, "name");
  
        options.ClaimActions.MapJsonKey("gitlab:avatar_url", "avatar_url");
        options.ClaimActions.MapJsonKey("gitlab:profile_url", "web_url");
  
        options.SaveTokens = true;
  
        options.Events = new OAuthEvents
        {
          OnCreatingTicket = async context =&gt;
                {
                var request = new HttpRequestMessage(HttpMethod.Get, context.Options.UserInformationEndpoint);
                request.Headers.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
                request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", context.AccessToken);
  
                var response = await context.Backchannel.SendAsync(request, HttpCompletionOption.ResponseHeadersRead, context.HttpContext.RequestAborted);
                response.EnsureSuccessStatusCode();
  
                var user = JsonSerializer.Deserialize&lt;JsonElement&gt;(await response.Content.ReadAsStringAsync());
  
                context.RunClaimActions(user);
              }
        };
      });
  }
  </code></pre>
  
  <p>How can I implement such a system? </p>