Mulit-Tenancy Video Question

RentProperty

Thx For the Multi-Tenancy Video Support. Very insightful

2 Questions-->

We have always used the LoggedInUser approach as this would return a smaller data set no? Using protection rules would find ALL the records but render them invisible on the client side? Or does Aware In Fact implement parameters before it makes the query to the DB?

Secondly... You mention at the end of the video that it is Difficult to backup/restore data per tenant...
Does that imply that it is theoretically possible and if Yes... How would one approach this?

Thnx for all the new videos... They are really helpful and I'm certain they will also greatly assist new Awarers to get going. 🙂

kklosson

As one who hosts a multi-tenant app, I'll offer this. In my view, it is a good practice to rely first on access rights and protection rules for data access than on query configurations. I have no technical reason for this except to say that you will ultimately need to use access priv's and protection rules to ensure against users defeating a query to see more data than the query permits, which is relatively easy to do with some simple tools. With comprehensive protection rules, you may not need to configure your queries to discriminate a view to the loggedin user's account - just let the protection rules handle it.

On backing up data for a single tenant, you would have to create a number of SQL dump scripts to dump each specific table based on a selection. In my terms of service agreement, I specifically state that we will no do this and have no such obligation. We explain that users can extract their data via the user interface in various grid exports and reports. We frequently get questions like "if we stop using the service, can we get our data?" Generally, they don't realize what they are asking for since they wouldn't have a clue what to do with the raw data.

BenHayat

kklosson wrote
As one who hosts a multi-tenant app, I'll offer this. In my view, it is a good practice to rely first on access rights and protection rules for data access than on query configurations. I have no technical reason for this except to say that you will ultimately need to use access priv's and protection rules to ensure against users defeating a query to see more data than the query permits, which is relatively easy to do with some simple tools. With comprehensive protection rules, you may not need to configure your queries to discriminate a view to the loggedin user's account - just let the protection rules handle it.

Exactly right and that was the reason I asked for this video. Although I have done all this in my app, but I think this video sparks the idea, with new users coming to Aware.

johntalbott

RentProperty wrote
We have always used the LoggedInUser approach as this would return a smaller data set no? Using protection rules would find ALL the records but render them invisible on the client side? Or does Aware In Fact implement parameters before it makes the query to the DB?

kklosson wrote
With comprehensive protection rules, you may not need to configure your queries to discriminate a view to the loggedin user's account - just let the protection rules handle it.

Kingsley - do you the answer to RentProperty's questions above?

aware_support

We have always used the LoggedInUser approach as this would return a smaller data set no? Using protection rules would find ALL the records but render them invisible on the client side? Or does Aware In Fact implement parameters before it makes the query to the DB?

Depending on a rule, Aware IM may modify the query itself. If not, Aware IM will automatically filter all outgoing data according to protection rules. This makes it 100% secure. If you don't use protection rules you can get a hacker to send a query through a UI, which will return data he is not supposed to see.

Secondly... You mention at the end of the video that it is Difficult to backup/restore data per tenant...
Does that imply that it is theoretically possible and if Yes... How would one approach this?

You would write a database script to only extract data from the tables for a specific ID. This ID is the ID of the specific tenant. A table for every object with explicit reference to the Tenant will have this ID as a column. So it is possible, but it's a pain in the neck.

CalD

Thanks for the video - timely and insightful for a new user to aware who is writing a SaaS multi tenant (and multi company a level down) app, yes a single tenant can and will have multiple companies, seems a couple of protection rules depending on use level will save heaps of time and increase security... guess what I'm doing tonight....

RentProperty

Thanks For the feedback Aware & Everyone Else...

So in essence the Absolute nr one solution I suppose (In terms of Security & Performance) would be to implement both. I.e. Use LoggedInUser AND Protection rules. This way the Query Result Set can be made smaller BUT the protection rules protect against Hackers.

In terms of the Extraction of a single Tenant's Data... I would guess the easiest would then be to create a Relationship From every single table to the Tenant so that one doesn't have to struggle with tons of JOINS to get all the data.

Neway, thanks again for all the new videos and looking forward to more to come. I think we as users should Also start making these so that we can build up a massive portfolio of material, tips & tricks, that will help New users to get going a lot quicker and so growing the product and user base. Also this will make the learning cycle easier if one wants to appoint a new developer in the team. It's quite a struggle to find the right person and to get them comfortable with the tool fast enough so that they can start taking some of the load.

Me and Werner are planning to do one on Exposing JSON services for Consumption specifically by Native Android apps since we've done a TON of these now. Hope to get that out to you guys in the next month or 2.

kklosson

Now you are committed. Looking fwd to your video.

tford

Me and Werner are planning to do one on Exposing JSON services for Consumption specifically by Native Android apps since we've done a TON of these now. Hope to get that out to you guys in the next month or 2.

Looking forward to that, Hein!

In the mean time, could you give us some clues about how you've gone about doing this?

johntalbott

tford wrote
Me and Werner are planning to do one on Exposing JSON services for Consumption specifically by Native Android apps since we've done a TON of these now. Hope to get that out to you guys in the next month or 2.

Looking forward to that, Hein!

In the mean time, could you give us some clues about how you've gone about doing this?

Amen to that idea.

I have a fairly urgent need to figure this out. Any change you could put together a raw list of steps to get us pointed in the right direction?

hpl123

Hein/Werner,
Great stuff and I also really want to see this (steps/video). Thanks in advance

RentProperty

Cool, We've got pretty tight deadline this week for Tuesday, but After that I'll see how soon I can put something together.

Just to clarify... We'll demonstrate how we use it in a Native (Java developed) Android app... Unfortunately We haven't built any Mobile apps yet using the AwareIM/PhoneGap etc. We do Android(Java) development for all our mobile apps. 🙂

But I assume the services could be consumed in the same way if you build your apps using PhoneGap/JavaScript, so w'll just demonstrate how we approach this in terms of the requests and responses from the server.

Will update here as soon as possible!