2

I am trying to build a pure JavaScript rest-client application that must support anonymous retrieval of information from a REST server that already supports JWT for authentication/authorization for external applications. The server is already being used by other client applications supporting multi-tenancy. Actually embedding the tenant information in the JWT.

Besides that the application needs to support users(human beings) that will want to mark(or select) some resources as favorites so a mechanism is needed for users/role creation and further authentication/authorization for the users. But these users can't be isolated to a single tenant, they will want to use across tenant resources.

So, right now I found that I need to use a JWT value for the anonymous data retrieval that of course should be tenant-agnostic. This means that I have to create an user with a special role that just have permissions for read only resources, except for the permissions for user creation (when the clients do sign up) again this should be tenant-agnostic. And when the user log-in into the system the JWT should be replaced for the one that have the user credentials again tenant agnostic. I am not sure if this is entirely correct, so how should we handle a situation like this ?

My other concern is, that we have the same back-end supporting authentication and credentials storage for human clients (tenant-agnostic) and application clients (tenant-aware), so there is logic that is a little bit more complicated in order to handle the privileges and tenant restrictions here. This could be just my impression but I feel that there should be a separation between application users and human users in the logic and/or data store.

But I am not completely sure and I want to know if some of you have previous experience or could have some ideas about this topic ?

Improve this question

1 Answer 1

Reset to default
1

Can you try the following approach, Create the users, assign the users with a read-only role for the tenants to which they need access to.

The data would be like User1 - tenant1 - administrative role User1 - tenant2 - data reader role User1 - tenant 3 - user role

In the jwt, we ensure that the user is authorized. Then we get the list of accessible tenants and see if he has access to the requested tenant data w.r.to the above data and then complete the authorization.

HTH

Improve this answer
Sign up to request clarification or add additional context in comments.

2 Comments

Thank you I will try your approach and comment the experience again, maybe my question was too opinion based
In the end I've used your approach of role based logic, replacing JWT on client for anonymous or authenticated user, the data storage for tenant-agnostic users is separated now and I find out that is useful to separate tenant information from JWT itself, right now I am using a special header on every request. And it is working and is maintainable for now. Thank you for your idea.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.