Skip to main content

User Authentication schemes in a Multi-Tenant SaaS Application

User Authentication in Multi-Tenant SaaS Apps

Introduction

We will cover few scenarios that we can follow to perform the user authentication in a Multi-Tenant SaaS application.


Scenario 1 - Global Users Authentication with Tenancy and Tenant forwarding

In this scheme, we have the SaaS Provider Authentication gateway that takes care of Authentication of the users by performing the following steps

  1. Tenant Identification
  2. User Authentication
  3. User Authorization
  4. Forwarding the user to the tenant application / tenant pages in the SaaS App

This demands that the SaaS provider authentication gateway be a scalable microservice that can take care of the load across all tenants. The database partitioning (horizontal or other means) is left upto the SaaS provider Service.

Scenario 2 - Global Tenant Identification and User Authentication forwarding

 


In the above scenario, the tenant identification happens on part of the SaaS provider Tenant Identification gateway. Post which, the user is redirected to tenant specific authentication schemes or pages.

This is analogous to that of the Microsoft Office login, where we provide the email address, the system identifies the tenant and federates the user to the tenant specific login model

Ex: On-Premise Ad, Office 365 Accounts, Federated SSO, Google SSO etc

Scenario 3 - Global User Authentication and Tenant forwarding

In this scenario, we have the users at a global level and the user authentication is happening at the SaaS User Authentication Gateway. In this case, we have a global pool of users. Upon login, we validate the user and then post which we identify the tenant mappings that a user has. The user then chooses the tenant and post which the tenant specific Authorization happens and the user uses the application.

Use Case for Scenario 3

In case of a service provider like a Financial Auditing firm, we can have all the auditors register with the SaaS firm. Once they are allocated to a specific Company (Microsoft , Google), the SaaS Provider application will have the mapping for the user with the firm.

Post login, the user will be redirected to a page, where he / she can choose the firm in which they need to operate and then they can perform the operations

Advantages

In this model, the authentication and user management are not burden for the tenants

The Tenant has their authorization within their application, even as a AuthZ microservice

Summary

We have discussed couple of approaches, these are not the only ones available, I just happen to write this blog post when trying to answer a question in Stackoverflow.

Hope this helps

Labels:

Comments

Post a Comment

Popular posts from this blog

hide the reply option for all the commented wireposts in the "thewire posts"

This option is implemented by checking whether the comment text has a @ and if so, we just indent it and hide the reply link from the user so that this comment cannot be commented. /home/webmaster/public_html/mod/thewire/views/default/object/thewire.php 1. check for the @ in the text [code]     $haystack= $vars['entity']->description;     $needle = "@";     if($haystack[0] == $needle)         $shallIndent = TRUE;     else         $shallIndent = FALSE; [/code] 2. use the indentation for the div which is a comment or a reply to a post made earlier. [code]  if($shallIndent)     {         ?> <!-- style="margin-left:50px"--> <div class="thewire-singlepage"  style="margin-left:50px"> <?php } else { ?> <div class="thewire-singlepage">     ...
Post a Comment
Read more

Download CSV file using JavaScript fetch API

Downloading a CSV File from an API Using JavaScript Fetch API: A Step-by-Step Guide Introduction: Downloading files from an API is a common task in web development. This article walks you through the process of downloading a CSV file from an API using the Fetch API in JavaScript. We'll cover the basics of making API requests and handling file downloads, complete with a sample code snippet. Prerequisites: Ensure you have a basic understanding of JavaScript and web APIs. No additional libraries are required for this tutorial. Step 1: Creating the HTML Structure: Start by creating a simple HTML structure that includes a button to initiate the file download. <!DOCTYPE html> < html lang = "en" > < head > < meta charset = "UTF-8" > < meta name = "viewport" content = "width=device-width, initial-scale=1.0" > < title > CSV File Download </ title > </ head > < body > ...
Post a Comment
Read more

http/3

Introduction HTTP/3 is the 3rd major version of the HTTP protocol that powers the internet. In comparison with the previous version of http which relied on TCP, http/3 relies on QUIC. QUIC Specification published at 6th June, 2022 Developed initially at Google in 2012, had its way to IETF and public by 2022. A decade for completion and standardization !!! Are the semantics like requests, methods, status codes still the same like previous versions of http/2? yes, they still remain the same The underlying mechanisms are changed, like http/3 uses space congestion control over UDP (User Datagram protocol) Head-Of-Line Blocking (HOL) This is a performance problem where there is a queue of packets built due to the first packet that is yet to be consumed. We have browsers that have limits on the number of parallel requests that it can send to a server, when they are used up, as we anticipate, a Queue is formed for the newer requests that start accumulating the newer requests till the former ...
Post a Comment
Read more

SFTP and File Upload in SFTP using C# and Tamir. SShSharp

The right choice of SFTP Server for Windows OS Follow the following steps, 1. Download the server version from here . The application is here 2. Provide the Username, password and root path, i.e. the ftp destination. 3. The screen shot is given below for reference. 4. Now download the CoreFTP client from this link 5. The client settings will be as in this screen shot: 6. Now the code to upload files via SFTP will be as follows. //ip of the local machine and the username and password along with the file to be uploaded via SFTP. FileUploadUsingSftp("172.24.120.87", "ftpserveruser", "123456", @"D:\", @"Web.config"); private static void FileUploadUsingSftp(string FtpAddress, string FtpUserName, string FtpPassword, string FilePath, string FileName) { Sftp sftp = null; try { // Create instance for Sftp to upload given files using given credentials sf...
2 comments
Read more