how does multi tenancy work in cloud? #160
-
|
When a user is signing up via github, an identity is created that binds that github id. Presumably in a self hosted environment this would be solved by using distinct oauth client ids per tenant, but i couldn't find those in cloud. |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 4 replies
-
|
If you want a full separation between identity "spaces" by tenant, you may be better off creating a project per tenant (which is possible via API & CLI). You'll have to manage the tenant configurations and provisioning, but you get full flexibility. Alternatively, you could allow for multiple tenant_ids in your schema if you want to have centralized accounts and want to activate them for each tenant. Then you'll want to tweak the flows to add tenants to an existing account on registration and to e.g. reject login when the user isn't mapped to the tenant in question - depending on your desired behavior. |
Beta Was this translation helpful? Give feedback.
-
|
thanks, we decided to put tenants into the schema. but this is a bit scary because its not clear which part of an identity is editable by users. could you point me at how a schema would look like that adds this safely? |
Beta Was this translation helpful? Give feedback.
-
|
Hello @aep If you use |
Beta Was this translation helpful? Give feedback.
-
|
metadata seems to work out of the box (since its schemaless) thanks. but is it safe to use for this purpose? i'm worried about discovering later that it could get manipulated |
Beta Was this translation helpful? Give feedback.
-
|
You can use it for that purpose! Metadata can only be changed by admins: https://www.ory.sh/docs/kratos/manage-identities/managing-users-identities-metadata#metadata |
Beta Was this translation helpful? Give feedback.
If you want a full separation between identity "spaces" by tenant, you may be better off creating a project per tenant (which is possible via API & CLI). You'll have to manage the tenant configurations and provisioning, but you get full flexibility.
Alternatively, you could allow for multiple tenant_ids in your schema if you want to have centralized accounts and want to activate them for each tenant. Then you'll want to tweak the flows to add tenants to an existing account on registration and to e.g. reject login when the user isn't mapped to the tenant in question - depending on your desired behavior.