A tenant-specific endpoint routes authentication requests and token exchanges through an endpoint associated with one tenant. Separating these routes helps keep tenant sessions and authentication flows isolated. section 13.4
Separate authorization routes
A multitenant application can direct Tenant 1 to https://idp.example.com/tenant1/authorize and Tenant 2 to https://idp.example.com/tenant2/authorize. Each tenant therefore uses its own authorization route instead of sharing one endpoint. section 13.4
{
"sub": "user567",
"tenant_id": "megamart", #1
"role": "inventory_manager",
"permissions": ["view_reports", "manage_suppliers"]
}
Tenant-aware claims can complement endpoint separation by identifying the tenant and permissions in returned identity data. section 13.4
