How to design Tenant based roles in a multi-tenant SaaS application

The need

Q: Why do we need the option to allow tenant's to create their own roles?

A: So that they can correlate their business roles with the SaaS application roles rather than try to create a mental map of what business role maps to which application role

Q: It seems quite useful, but how much of an effort is this?

A: Though it seems to be a little more work, it is quite simple. This post will walk through how to build and use this model.

Database Design

In the database (which ever multi-tenancy level is chosen), we need a table which we can call it as Roles. This table normally contains the following attributes

Roles (id, name, description, createdby, createdon, updatedby, updatedon, status/isActive)

 This table allows all the roles to be at the global level. There will be another table called as Tenant Role which map the roles against the tenant's

TenantRoles(id, tenantId, roleId, mappedby, mappedon, updatedby, updatedon, status/isActive)

In this table, we are mapping the roles to the tenants. Remember if the tenant has his own database, in that case, we can use only `Roles` table with all the tenant specific role

Illustration of the above logic to visualize how the tenant role are mapped

Visualization of tenant roles

Role Permissions / Privileges

The roles in-turn will have permissions which can be tied to the role. The mapping works in the below given order

1. There will be a global mapping of roles and permissions

2. Whenever the tenant customizes a role / creates new roles and manages the permissions to those roles, we maintain them in the role permissions or role privileges table

The visualization of the same is given below for reference

Mapping of roles and permissions

Policies

We can also build policies that can be created and applied to entities or collections of entities, which I will plan to explain in another upcoming blog post.

Hope this helps any team working in building a multi-tenant RBAC (Role Based Access Control) mechanism for their SaaS applications / suite.