2

I have this IdentityServer which handles authentication and authorization. It saves users, roles, claims, etc in its own database.

Then, I have a web app that needs to protect some resources to specific roles. This is, of course, handled by the IdentityServer.

Now, the question is, I need to associate some entities in my webapp to a specific user. Before moving authentication to a separate IdentityServer we simply had a 1-1 SQL relationship in our database. But now, since users lives in a different database, we can't simply do that.

So, what's the proper approach to handle this relationship between entities that lives in different databases?

  • Authentication and authorization are different matters. Probably you will have to replicate data on the web app side for you to implement its security policies. Unless you want to be constantly asking whether a user has or has not the right role to the ID Service. – Laiv Nov 26 '18 at 14:23
  • The relationship I'm trying to express here it's not about authorization. It's about ownership. This entity belongs to that user. This relationship is not used for any authorization purposes. Authorization is done through the use of roles and claims. This is actually not important to answer the question. – emzero Nov 26 '18 at 14:31
  • Perhaps you could update your question with the clarification. protect some resources to specific roles is the definition of authorization. – Dan Wilson Nov 26 '18 at 14:36
  • 1
    tenancy is a sort of "authorization by ownership". As @amon as answered, you still have to store user's ID on both sides. – Laiv Nov 26 '18 at 14:49
6

Your design doesn't change much. You still have the same foreign-key relationship. However, your database can no longer apply any foreign-key constraint. You will have to check the validity of IDs within your application, and also perform any joins manually within your application.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.