title: IdentityServer4 custom AuthorizeInteractionResponseGenerator
body: <p>Sadly documentation on the implementation of a custom <code>AuthorizeInteractionResponseGenerator</code> in IdentityServer4 is sorely lacking.</p>
  
  <p>I'm trying to implement my own <code>AuthorizeInteractionResponseGenerator</code> because I need a further step of user interaction (after authentication).  My scenario is that a single identity (email) can be associated with multiple tenants.  So after logon, I need the user to be presented with a list of associated tenants, so that they can choose one.</p>
  
  <p>I have evaluated the source code, and have come up with the the following custom <code>AuthorizeInteractionResponseGenerator</code>:</p>
  
  <pre><code>public class AccountChooserResponseGenerator : AuthorizeInteractionResponseGenerator
      {
          public AccountChooserResponseGenerator(ISystemClock clock, 
              ILogger&lt;AuthorizeInteractionResponseGenerator&gt; logger, 
              IConsentService consent, IProfileService profile) 
              : base(clock, logger, consent, profile)
          {
          }
  
          public override async Task&lt;InteractionResponse&gt; ProcessInteractionAsync(ValidatedAuthorizeRequest request, ConsentResponse consent = null)
          {
              var response = await base.ProcessInteractionAsync(request, consent);
              if (response.IsConsent || response.IsLogin || response.IsError)
                  return response;
  
              return new InteractionResponse
              {
                  RedirectUrl = "/Organization"
              };
          }
      }
  </code></pre>
  
  <p>It inherits from the base AuthorizeInteractionResponseGenerator built into IdentityServer4, so that the standard Logon and Consent pages can show.  This happens, and then the user is correctly redirected to the <code>/Organization</code> url to select an organization (tenant).</p>
  
  <p>But what then?  With the lack of documentation and examples, I'm really struggling to figure out the following two questions:</p>
  
  <p>1) How do I now, having selected a Tenant, indicate to my custom AccountChooserResponseGenerator that my interaction is complete, and that the user can now be redirected back to the Client?</p>
  
  <p>Edit:</p>
  
  <p>Answer to 1: To indicate that the interaction is complete, you I have to return an empty new InteractionResponse().  In my case, a check for the existence of the TenantId claim sufficed, as follows:</p>
  
  <pre><code>if (!request.Subject.HasClaim(c=&gt; c.Type == "TenantId" &amp;&amp; c.Value != "0"))
                  return new InteractionResponse
                  {
                      RedirectUrl = "/Organization"
                  };
  
              return new InteractionResponse();
  </code></pre>
  
  <p>2) And how can I get information about the selected Tenant to be added to the identity token that IdentityServer4 passes back to the Client?</p>
  
  <p>Edit: Answer to 2: In the Controller Action method that gets executed after selecting a Tenant, I called :</p>
  
  <pre><code> await HttpContext.SignInAsync(User.Claims.Single(r=&gt; r.Type == "sub").Value,
                  new System.Security.Claims.Claim("TenantId", tenant.Id.ToString()));
  
              return Redirect(ReturnUrl);
  </code></pre>
  
  <p>...which is an <a href="http://docs.identityserver.io/en/latest/topics/signin.html" rel="noreferrer">IdentityServer4-provided Extension</a> to HttpContext.</p>