Multi-Tenancy Login question

Markfre1

I'm setting up a Multi-tenant app and ran into an issue.

I want to use the users EMAIL as their login name. But this causes the following problem.

Let's assume there are a 1000 Franchise stores individually owned. The admin sets up a staff user, using their email. No problem.

Now the staff user leaves, and goes to work for another of the Franchise stores. So if the user was not deleted from the original Franchise, when te logs in in, he would be getting into the original store. I can't assume that the original store admin will remove the employee. Now that I think about it, the user is already setup in the system, and has a password. So it brings up issues, do we create the user again with the store id, and new password (not even sure AIM lets you have the same username in more then once).

A couple ideas I had:

When the user logs in, it can do a firstcommand and display a list of stores that they are registered in, and they can select the one they want to work in. From there we just use their tenant id for everything. However that still leaves a password issue. (not sure how to handle this).

Another idea which I don't know if possible, is during login, is for the User to enter their store id, email, and password. But now they have to remember a store id as well and you have to have recovery for that as well.

Just as a note: I setup in another application one of my companies using my email. Then I have another independent company which I setup and used the same email. They use a URL system and change it slightly for each company. When you put in your email, the display a list of companies to log into. In AIM maybe, do the same?

A standard login (non email) resolves these issues as it wouldn't let a store create the same users login name. Email name with a Tenant ID on initial login but AIM only allows username and password.

Just email is the best and if we can get a good method, it would enhance the SaaS capability of AIM.

Wracking my brain on this one but the handling the login for muti-tenancy has to be good and secure. I just may have to go to a user name, but don't want to.

Thanks in advance for any suggestions.

Mark

Markfre1

One quick followup. I went into another companies multi-tenant app and when I try to use the same user name, it tells me its in use. So this company only lets you use your email for one company.

This would be probably be ok in general muti-tenant apps, but in the case of franchises, I could see a user jumping from one to another.

Mark

Markfre1

One more note: On this other product when I sent an invitation to myself which was already registered as a user in another company.

They said this was registered and just to login. When I logged in, it did show the companies I was tied to. So maybe I just need to have one password, one user, with an invitation sent to the user with a temporary password and then they can create their own, and the admin doesn't set this.

Need to think this through. Feedback?

Thanks,

Mark

kklosson

I have a multi-tenant app. For login name I use AccountID + UserID. The account ID in my case is a code I give to the account, like RAH or whatever, which is a unique string in the system. So the user's login name might be RAH1294. Totally unique. Forget email address as login ID.

Markfre1

I think I got the email figured out but not sure I am going that route.

So to clarify what you are saying, when the user creates their user name, you are changing their name by adding an Account Id in front.

So if I create Markf, with a password. Markf is going to end up as ABC-Markf.

How does that come off. Do you display a user name box like

ABC-xxxxxxxx where they fill in xxxxxxx. So they know their user name includes the ABC.

Mark

kklosson

I don't have self-registration and users are created by other users in the account so the scheme may need revisions. But I suggest that the user's Login Name be system generated. Let them provide an email address but set the login name via a process and send it to them in an email or something.

Markfre1

I may use your idea but in my case their is the initial user (lower level admin) who creates the account through self registration. This admin creates users of the account which would include staff and outside users such as their accountant who would be notified through email. The thought was they login with the email and then set up their password. I think I have enough to work with.

While were on the subject of Multi-tenancy. Are you using 1 database and segregating the data via a tenantid or are you setting up seperate BSV's? My plan is to have all tenants in one database up to a point. Because I could have users coming in at all hours setting up accounts.

I do have questions when I get further along, such as I may not want no more then x amount of companies in one database or one server, and therefore may have to route to another server or BSV? This is an area where I don't have the expertise but it would be a good problem to have. Once the app is further along, I would like to see what others are doing. Load balancing, etc. I was planning on hosting on AWS.

Mark

kklosson

I host on AWS. Have not set up load balancing but I have separate db and app servers. Works like champ.

Markfre1

Meaning you use seperate BSV's?

Mine is a mass scale accounting app, so with self registration, I cannot set up seperate BSV's as much as I would like to keep data segregated by company.