Kephas.Tenants 11.0.0-dev.3

Tenants

Introduction

This package adds support for multi-tenant applications.

How it works:

• Include the Kephas.Tenants package in the application deployment.
• The application receives the tenant identifier through the tenant command line argument or the KEPHASAPP_Tenant environment variable.
• The tenant is available in code through IAppArgs.Tenant() extension method or the IContext.Tenant() extension method.
  • Note that IAppArgs are available through dependency injection and IContext instances through the parameter received in context dependent invocations.
• When setting up the IAmbientServices during application bootstrapping, make sure to invoke the ambientServices.WithTenantSupoport().
  • Do this typically before setting up the application runtime (for example WithStaticAppRuntime, WithDynamicAppRuntime, or WithPluginsAppRuntime), to make sure the runtime accesses the correct locations.

What is the immediate effect:

• Tenant administrative mode
  • When the application was started without a tenant identifier specified either in command line arguments or in the environment variables. This mode should allow tenant management actions.
  • The folder locations are not changed.
• Tenant specific mode
  • The tenant identifier is passed to the running application.
  • The folder locations (config, licenses, plugins) are found in the {tenant} subdirectory of the original folder locations.

Example

public static IAmbientServices SetupAmbientServices(
    this IAmbientServices ambientServices,
    Func<IAmbientServices, IEncryptionService> encryptionServiceFactory,
    IConfiguration? configuration,
    IAppArgs appArgs)
{
    return ambientServices
        .WithDefaultLicensingManager(encryptionServiceFactory(ambientServices))
        // Do not forget setting up the tenant support right *after* setting up the application runtime.
        .WithTenantSupport(appArgs)
        //
        .WithDynamicAppRuntime()
        .WithSerilogManager(configuration);
}

Security

Tenants management

A global scope tenantsmanagement permission is provided to require in endpoints or other application actions affecting overall tenants management.

Tenant admin

A global scope tenantadmin permission is provided to require in endpoints or other application actions affecting management of the tenant.

Example

/// <summary>
/// Endpoint message for adding a tenant.
/// </summary>
[RequiresPermission(typeof(TenantsManagementPermission))]
public class AddTenantMessage : IMessage
{
    //...
}

/// <summary>
/// Endpoint message for changing the tenant information.
/// </summary>
[RequiresPermission(typeof(TenantAdminPermission))]
public class ChangeTenantInfoMessage : IMessage
{
    //...
}

Configuration

Tenant specific

The TenantSettings are available through the injectable IConfiguration<TenantSettings> service. It provides:

• DisplayName (string): The tenant's display name.
• Domains (string[]): an array of domain owned by the tenant. These domains are typically used in the authorization process to identify the tenant a user belongs to.

Example

var config = injector.Resolve<IConfiguration<TenantSettings>>();
var settings = config.GetSettings(context);
settings.DisplayName = "My changed name";
await config.UpdateSettingsAsync(settings, context).PreserveThreadingContext();

Tenant management

The TenantsManagementSettings are available through the injectable IConfiguration<TenantsManagementSettings> service. It provides:

• GlobalAdmin (GlobalAdminSettings): settings for the global tenants administrator.
• Tenants (TenantSettings[]): list of settings for the application tenants.