Multiple AD authentication schemas - cannot run .NET 7 web API when I add multiple providers

I'm building a multi-tenant SaaS application and I need to have multiple ADs as the authenticators to the application.

When i configure one AD at a time, it work 100% fine.
The problem is when i have to initialize multiple MicrosoftIdentity providers.

In this solution, i built a Singleton that will load all the provider information. At the moment, it is mocked like this:

public class TenantProvider
    {
        private static TenantProvider _instance;
        private static readonly object _lock = new object();

        public List<Tenant> tenants { get; set; }

        private TenantProvider() 
        { 
            tenants = new List<Tenant>();

            //mock1
            tenants.Add(new Tenant
            {
                instance = "https://login.microsoftonline.com/",
                domain = "MyDomain",
                tenantId = "MyTenantId",
                clientId = "MyClientId",
                callbackPath = "/signin-oidc",
                allowedHosts = "*"
            });

            //mock2
            tenants.Add(new Tenant
            {
                instance = "https://login.microsoftonline.com/",
                domain = "MyDomain2",
                tenantId = "MyTenantId2",
                clientId = "MyClientId2",
                callbackPath = "/signin-oidc",
                allowedHosts = "*"
            });
        }

        public static TenantProvider Instance()
        {
            lock (_lock)
            {
                if (_instance == null)
                {
                    _instance = new TenantProvider();
                }
            }
            
            return _instance;
        }

This Singleton will return all my providers so that in my Program.cs i could add all the identities like in this code:

foreach(var tenantProvider in TenantProvider.Instance().tenants)
{
    Action<JwtBearerOptions> configureJwtBearerOptions = JWTBearerOptions;
    void JWTBearerOptions(JwtBearerOptions t1)
    {
        t1.Audience = $"{tenantProvider.instance}/{tenantProvider.tenantId}";
        t1.TokenValidationParameters.ValidAudiences = new string[] {
            tenantProvider.clientId,
            $"api://{tenantProvider.clientId}"
        };
    }

    Action<MicrosoftIdentityOptions> configureMicrosoftIdentityOptions = MIOptions;
    void MIOptions(MicrosoftIdentityOptions t2)
    {
        t2.TenantId = tenantProvider.tenantId;
        t2.ClientId = tenantProvider.clientId;
        t2.Instance = tenantProvider.instance;
        t2.Domain = tenantProvider.domain;
    }

    builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
                  .AddMicrosoftIdentityWebApi(configureJwtBearerOptions,
                                              configureMicrosoftIdentityOptions);
}

When i have only one provider in my TenantProvider, everything works fine.
When i activate the second provider, i have the following error:
System.InvalidOperationException: 'Scheme already exists: Bearer'

Is there a way to implement multiple Identity Providers on the .NET API? (Multiple AD providers) (NOT B2C)

I actually solved my problem.
I addedd PolicySchemeOptions, in addition to creating AuthenticationSchemes dynamically, with specific schemeNames for each of AD providers.

As long as I'm still mocking with personal AD, i have some IFs statements inside the PolicySchemeOption

Here's my actual solution:

foreach (var tp in TenantProvider.Instance().tenants)
{
    builder.Services
    .AddAuthentication(o => { o.DefaultAuthenticateScheme = "AAD-" + tp.name; o.DefaultChallengeScheme = "AAD-" + tp.name; })

    .AddPolicyScheme("AAD-" + tp.name, "AAD-" + tp.name, o => {
        o.ForwardDefaultSelector = context =>
        {
            string _providerSelected = string.Empty;
            string authorization = context.Request.Headers[HeaderNames.Authorization];
            if (!string.IsNullOrEmpty(authorization) && authorization.StartsWith("Bearer "))
            {
                var token = authorization.Substring("Bearer ".Length).Trim();
                var jwtHandler = new JwtSecurityTokenHandler();
                var claims = jwtHandler.ReadJwtToken(token).Claims;

                var email = string.Empty;

                try
                {
                    email = claims.FirstOrDefault(x => x.Type == "email").Value;
                }
                catch
                {
                    email = claims.FirstOrDefault(x => x.Type == "unique_name").Value;
                }

                MailAddress address = new MailAddress(email);
                var domain = address.Host;

                if (domain == "hotmail.com")
                {
                    _providerSelected = "enzo";
                }

                foreach (var tp in TenantProvider.Instance().tenants)
                {
                    if (domain.Contains(tp.name))
                    {
                        _providerSelected = tp.name; break;
                    }
                }
            }
            return _providerSelected;
        };
    })

    .AddMicrosoftIdentityWebApi(o => {

        o.Audience = $"{tp.instance}/{tp.tenantId}";
        o.TokenValidationParameters.ValidAudiences = new string[] {
                    tp.clientId,
                    $"api://{tp.clientId}"
                    };

    }, o => {
        o.TenantId = tp.tenantId;
        o.ClientId = tp.clientId;
        o.Instance = tp.instance;
        o.Domain = tp.domain;
    }, tp.name);
}

Foreach tenant in my tenantProvider, i add a new AuthenticationScheme.

This way, i can dynamically add how many AD providers i need and the Authentication works as expected, as long as the user has access to the specified AD.

After debugging, I found Bearer has add twice and throw this exception, so I want to change the Scheme. Like below screenshot. The issue could be fixed.

Add authenticationScheme in you Tenant class. And change your code like below.

public class Tenant
{
    public string? instance { get; set; }
    public string? domain { get; set; }
    public string? tenantId { get; set; }
    public string? clientId { get; set; }
    public string? callbackPath { get; set; }
    public string? allowedHosts { get; set; }
    public string? authenticationScheme { get; set; }
}

Program.cs

        foreach (var tenantProvider in TenantProvider.Instance().tenants)
        {
            Action<JwtBearerOptions> configureJwtBearerOptions = JWTBearerOptions;
            void JWTBearerOptions(JwtBearerOptions t1)
            {
                t1.Audience = $"{tenantProvider.instance}/{tenantProvider.tenantId}";
                t1.TokenValidationParameters.ValidAudiences = new string[] {
                     tenantProvider.clientId,
                     $"api://{tenantProvider.clientId}"
                };
            };

            Action<MicrosoftIdentityOptions> configureMicrosoftIdentityOptions = MIOptions;
            void MIOptions(MicrosoftIdentityOptions t2)
            {
                t2.TenantId = tenantProvider.tenantId;
                t2.ClientId = tenantProvider.clientId;
                t2.Instance = tenantProvider.instance;
                t2.Domain = tenantProvider.domain;
            }
            builder.Services.AddAuthentication(tenantProvider.authenticationScheme)
.AddJwtBearer(tenantProvider.authenticationScheme, configureJwtBearerOptions);

            builder.Services.Configure<JwtBearerOptions>(tenantProvider.authenticationScheme, JWTBearerOptions);

            builder.Services.Configure<MicrosoftIdentityOptions>(tenantProvider.authenticationScheme, MIOptions);

            builder.Services.AddAuthorization(options =>
            {
                options.AddPolicy($"{tenantProvider.authenticationScheme}-policy",
                    policy => policy.RequireAuthenticatedUser());
            });

        }