Tenants All the Way Down: How Userfront Handles Access Management

Access management is necessary for any application. Whether you serve individuals or Fortune 500 customers, your app will need a way to grant and restrict access to specific resources for specific organizations or end users.

This blog post explores various approaches to access management, focusing on the flexibility provided by tenants, child tenants, and multi-tenancy.

Business Benefits of Fine-Grained Access Control

1. Enhanced Security: By ensuring that users only have access to the resources necessary for their role, organizations can significantly reduce the risk of data breaches and unauthorized access.
2. Compliance: Fine-grained access control helps organizations meet regulatory requirements by providing detailed audit trails and ensuring that access policies are strictly enforced.
3. Operational Efficiency: Proper access control streamlines operations by minimizing the potential for errors and ensuring that users have timely access to the resources they need.
4. Scalability: As organizations grow, fine-grained access control can easily scale, allowing for efficient management of increasing numbers of customers, users, teams, and resources.

Flexibility in Access Management with Userfront

To understand the full capabilities of access management with Userfront, it is important to understand a few core concepts.

Tenants

In Userfront, a tenant represents a workspace, team, or organization within an application. Each tenant can have multiple users, each assigned specific roles. This allows for granular control over who can access what within the tenant. For instance, roles like admin, author, or developer can be customized to fit the specific needs of the application.

Key Features:

• Role Assignment: Users can be assigned roles that define their access levels within a tenant. This is reflected in their JWT access tokens, allowing the application to verify and enforce these roles.
• Multi-Tenancy: A user can belong to multiple tenants, and each tenant can have its own set of roles and permissions. This is ideal for applications serving multiple organizations or teams.

Child Tenants

Child tenants are useful for organizations that require a hierarchical structure within their access management framework. For example, a parent company might have multiple subsidiaries, each functioning as a child tenant. This setup allows for centralized control while delegating specific access and management capabilities to the child tenants.

Key Features:

• Hierarchical Access Control: Parent tenants can define overarching policies and roles, while child tenants can have their own tailored roles and permissions.
• Scalability: As organizations expand, new child tenants can be added without disrupting the overall access control framework.

Multi-Tenancy

Multi-tenancy is a model that allows multiple independent instances of one or more applications to operate in a shared environment. Each tenant is isolated from the others, ensuring data security and privacy while sharing the same infrastructure.

Key Features:

• Resource Efficiency: By sharing infrastructure, multi-tenancy reduces costs and improves resource utilization.
• Isolated Workspaces: Each tenant operates in an isolated environment, ensuring that the activities and data of one tenant do not impact others.
• Customizable Roles: Each tenant can have its own roles and permissions, allowing for highly customized access control tailored to the needs of each tenant.

Let’s look at an example. In the above diagram, “Your Service” is your application. The top-level “Customer account” is a tenant within your application. In this instance, the customer has sub-projects, each with multiple users — each of these projects would be considered child tenants.

With Userfront, you can control who has access (and what they can access) at each tenant and child tenant. Additionally, you could have child-tenants infinitely nested depending on your hierarchical needs. In other words, it’s tenants all the way down.

Different Access Management Structures

With a basic understanding of tenants and child-tenant relationships, applications can build out access management systems that fit unlimited use-cases.

The most basic structure could be used when only serving individual user accounts. However, when users want to join an existing account, having the account information attached to the user will cause problems.

A more scalable solution is to create organizational (a.k.a. tenant) accounts from the beginning. This approach allows users to have roles within an tenant, such as admin or member. This model not only simplifies user management but also supports scalability as your business grows.

As your service grows, end-users might have multiple projects and need a streamlined way to manage them. Instead of managing separate logins for each project, you could structure your access control system to allow tagging projects and assigning roles based on these tags.

Alternatively, nesting projects under a customer account allows for role-based access at both global and project levels. This is the child-tenant approach we mentioned earlier, which is probably the most flexible and scalable out of all access control structures.

Lastly, your organization will likely need to grant customer support access to customer accounts and customer projects. For these scenarios, you may want to have a small group of people with full admin access at all levels. Those admins can then assign support staff to a single account or single project. This setup ensures larger customers remain satisfied and compliant with their internal security policies.

Implementing Access Management with Userfront

Userfront provides a comprehensive API to manage tenants, roles, and access control effectively. Here’s a brief overview of how to use these features:

• Creating Tenants and Child Tenants: Using the Userfront API, admins can create tenants and define child tenants within them. This structure supports complex organizational hierarchies and ensures scalable access management.
• Assigning Roles and Permissions: Userfront allows for the creation and assignment of roles at both the tenant and application levels. This ensures that users have the appropriate access based on their roles within the organization​.
• Using JWT Access Tokens: Roles and permissions are included in the JWT access tokens, which can be verified by the server to enforce access control. This ensures secure and efficient verification of user permissions​.

Userfront’s flexible approach to tenants, child tenants, and multi-tenancy provides a flexible framework for implementing effective access management. By leveraging these features, organizations can scale their operations securely and efficiently, meeting the diverse needs of their users.

For more detailed information on implementing these features, refer to the Userfront documentation:

• Multi-Tenancy
• Server-to-server API reference

‍