I'm in the process of building a new API that needs to support multitenancy.
I can figure out how to implement reading and writing the data securely without having to worry about clients being able to know about (or see) other tenants data.
I can also understand how to determine the right tenant for authenticated endpoints (I.E. using a tenant id in a JWT).
For anonymous endpoints however I don't know how to approach this. I came up with the following solutions:
Add a tenant id as a parameter. I dislike this because I would like the multitenancy to not be part of the resource endpoints.
- Easy to implement
- Does not feel like multi tenancy is 'transparent'
Create a tenant service which can generate an anonymous token (do not set the sub, just a tenant id).
- Adds transparency to the multi tenancy
- In a later stage, this token can be used as an exchange token together with user credentials to authenticate against a multitenant authentication service
- Adds another 'authentication endpoint'
Use application tokens. Each tenant then could have multiple clients which each authenticate with a key and secret. This extends the second solution and has it's own advantages and disadvantages on top: Pros
- Clients become users themselves
- Possibility to have scopes
- Adds more complexity (multi tenant clients need to have multiple tokens)
- Adds more administration, each client needs an application token per tenant
Because this is a crucial part of creating these endpoints (and it can become a lot of them) I would like to hear your opinion about these solutions, and maybe there are other approaches that I can't come up with, maybe there is a pattern for this that I can't find. Your input on this will be greatly appreciated.