app.Map("/tenants", multiTenantIdsvrMountPoint =>
            {
                // Saaskit.Multitenancy
                multiTenantIdsvrMountPoint.UseMultitenancy<IdsvrTenant>();
                multiTenantIdsvrMountPoint.UsePerTenant<IdsvrTenant>((ctx, builder) =>
                {
                    var mountPath = "/" + ctx.Tenant.Name.ToLowerInvariant();
                    // we mount the tenant specific IdSvr4 app under /tenants/<tenant>/
                    builder.Map(mountPath, idsvrForTenantApp =>
                    {
                        var identityServerOptions = idsvrForTenantApp.ApplicationServices.GetRequiredService<IdentityServerOptions>();

                        // we use our own cookie middleware because Idsvr4 expects it to be included in the
                        // pipeline as we have changed the default authentication scheme
                        idsvrForTenantApp.UseCookieAuthentication(new CookieAuthenticationOptions()
                        {
                            AuthenticationScheme = identityServerOptions.AuthenticationOptions.AuthenticationScheme,
                            CookieName = identityServerOptions.AuthenticationOptions.AuthenticationScheme,
                            AutomaticAuthenticate = true,
                            SlidingExpiration = false,
                            ExpireTimeSpan = TimeSpan.FromHours(10)
                        });

                        idsvrForTenantApp.UseIdentityServer();

                        idsvrForTenantApp.UseMvc(routes =>
                        {
                            routes.MapRoute(name: "Account",
                                template: "account/{action=Index}",
                                defaults: new {controller = "Account"});
                        });
                    });
                });
            });

    public class ClientStoreResolver : IClientStore
    {
        private IClientStore _clientStoreImplementation;


        public ClientStoreResolver(IHttpContextAccessor httpContextAccessor)
        {
            if(httpContextAccessor == null)
                throw new ArgumentNullException(nameof(httpContextAccessor));

            // just to be sure, we are in a tenant context
            var tenantContext = httpContextAccessor.HttpContext.GetTenantContext<IdsvrTenant>();
            if(tenantContext == null)
                throw new ArgumentNullException(nameof(tenantContext));

            // based on the current tenant, we can redirect to the proper client store
            if (tenantContext.Tenant.Name == "first")
            {
                _clientStoreImplementation = new InMemoryClientStore(GetClientsForFirstClient());
            }
            else if (tenantContext.Tenant.Name == "second")
            {
                _clientStoreImplementation = new InMemoryClientStore(GetClientsForSecondClient());
            }
            else
            {
                // all other tenants have no clients registered in this example
                _clientStoreImplementation = new InMemoryClientStore(new List<Client>());
            }
        }

        public Task<Client> FindClientByIdAsync(string clientId)
        {
            return _clientStoreImplementation.FindClientByIdAsync(clientId);
        }

        private List<Client> GetClientsForFirstClient()
        {
            return new List<Client>
            {
                new Client()
                {
                    ClientId  = "FirstTenantClient",
                    AllowedGrantTypes = new []{ GrantType.AuthorizationCode },
                    RedirectUris = new List<string>()
                    {
                        "http://localhost:5000/signin-oidc"
                    },
                    ClientSecrets = new List<Secret>()
                    {
                        new Secret()
                        {
                            Value = "FirstTenant-ClientSecret".Sha256()
                        }
                    },
                    AllowedScopes = { StandardScopes.OpenId.Name, StandardScopes.Profile.Name },
                    RequireConsent = false,
                    PostLogoutRedirectUris = new List<string>()
                    {
                        "http://localhost:5000/"
                    }
                }
            };
        }

        private List<Client> GetClientsForSecondClient()
        {
            return new List<Client>
            {
                new Client()
                {
                    ClientId  = "SecondTenantClient",
                    AllowedGrantTypes = new []{ GrantType.AuthorizationCode },
                    RedirectUris = new List<string>()
                    {
                        "http://localhost:5001/signin-oidc"
                    },
                    ClientSecrets = new List<Secret>()
                    {
                        new Secret()
                        {
                            Value = "SecondTenant-ClientSecret".Sha256()
                        }
                    },
                    AllowedScopes = { StandardScopes.OpenId.Name, StandardScopes.Profile.Name },
                    RequireConsent = false,
                    PostLogoutRedirectUris = new List<string>()
                    {
                        "http://localhost:5001/"
                    }
                }
            };
        }
    }