A tenant is an independently scoped organization or customer population sharing one identity system while keeping its users, settings, roles, and access boundaries separate. OIDC multitenancy lets a single identity provider serve multiple tenants without mixing their identities or permissions. section 13.4 section 13.5
Use tenant boundaries when one platform serves:
- Multiple SaaS companies or customer organizations with separate users, data, and access controls. section 13.4
- Enterprise departments, business units, customers, vendors, or partners requiring tailored authentication. section 13.4
- Different login providers, such as Google, Azure AD, or a native system, routed according to tenant. section 13.5
Preventing tenant mix-ups
Use tenant-specific login URLs and issue tokens containing a tenant-specific claim such as tenant_id. Applications can then associate the authenticated user and permissions with the intended tenant rather than accepting an ambiguous identity. section 13.5 section 13.6
{
"sub": "user567",
"tenant_id": "megamart", #1
"role": "inventory_manager",
"permissions": ["view_reports", "manage_suppliers"]
}
A token example makes the boundary visible: tenant_id identifies the organization, while role and permissions describe that user’s allowed actions within it. section 13.4
