liveBook · Manning

Tenant-specific claim

As explained in Software Security for Developers

A tenant-specific claim is a token or identity assertion that identifies or describes a subject in the context of a particular tenant.

A tenant-specific claim is a token or identity assertion that identifies or describes a subject within a particular tenant. It lets each tenant use its own roles, privileges, and access-control structure without treating all tenants alike. section 13.4

A claim set for MegaMart

A user-info response can identify the tenant and carry tenant-defined authorization data: sub user567, tenant_id megamart, role inventory_manager, and permissions such as view_reports and manage_suppliers. section 13.4

{
  "sub": "user567",
  "tenant_id": "megamart",   #1
  "role": "inventory_manager",
  "permissions": ["view_reports", "manage_suppliers"]
}

Inspect the compact claim structure showing how tenant identity, role, and permissions travel together. section 13.4

How Software Security for Developers covers it

How deep it goes
Defines the claim through a user-info payload and stops short of specifying its implementation or validation details.
Examples
Uses a MegaMart payload containing sub, tenant_id, role, and permissions for inventory management.
What you can do after
Evaluate tenant-aware authorization data by reading tenant identifiers, roles, and permissions from a user-info response.
How it connects
Connects multitenancy with OpenID Connect, authorization, roles, permissions, identity providers, and tenant isolation.
Cover of Software Security for Developers
liveBookmanning.com
Read Software Security for Developers on liveBook Get the book at manning.com

This explainer was generated by Manning's knowledge graph from the text of Software Security for Developers. The section links point to the parts of the book it draws on.