Multi-Tenant Authorization

What is Multi-Tenant Authorization?

Multi-tenant authorization lets every part of your service (every microservice) serve multiple customers without deploying a separate instance for each. Read more in our blog.

Most modern applications, especially microservices-based ones, require some degree of multi-tenancy.

Multi-tenancy gives you:

• Access separation between customers, enforced by policy.
• Multiple customers served at once, on shared infrastructure and services.
• Load balancing and scaling across that shared infrastructure.

An authorization layer is a safe way to move from a single-tenant to a multi-tenant application. One policy applies the tenant separation across all relevant services, so the services themselves don't need to change.

Tenants in Permit.io

Tenants are a first-class concept in Permit.io: you manage them in the UI, the SDKs, and the API. A tenant usually represents one of your customers. Sometimes several tenants represent one logical customer, for example one tenant per department. Tenants are nested under environments

Silos of Resources and Users

Think of a tenant as a silo of resources and users. In policy terms, only users in a tenant can act on the resources in that tenant. Tenants are isolated from one another.

info

In Permit, tenants belong to the facts (data) layer. You can assign users to tenants, but you can't define different policies for each tenant's roles.

To isolate role schemas per tenant, use the Project and Environment hierarchy or role attributes through the API.

Assigning Users to Tenants

Users are assigned to tenants via a role.

Tenant Resources

To mark a resource instance as belonging to a tenant, pass the tenant key (or ID) in the resource object when you call permit.check(). Node.js example (the same applies in every SDK):

const permitted = await permit.check(userKey, "create", {
  type: "document", // The resource name
  tenant: tenantKey, // The tenant key
});

Resource types, unlike resource instances, belong to an environment, not to a specific tenant.

Tenant APIs

• Manage Tenants - Tenants API
• Assign a User to a Tenant - Role-Assignments API

Tenant UI

Manage tenants in the user management screen. Use the selector at the top left to switch tenants, rename them, and create new ones.