Authentication Proxy Token Patching for Multi-Tenant Applications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication protocols such as OpenID Connect (OIDC) do not enable multi-tenancy in applications, failing to provide specific tenant information such as tenant creation time, last-access time, etc.
Innovation Solution
A proxy system is deployed between an application and an authentication service provider to patch one or more authentication tokens with tenant-specific information, enabling multi-tenancy and providing tenant creation time, last-access time, etc.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If OpenID Connect (OIDC) is used for authentication, then authentication and authorization can be offloaded from applications, but multi-tenancy cannot be enabled and specific tenant information cannot be provided
Solution Approach 1:
An authentication proxy is introduced as an intermediary component between the application and the OIDC service provider. The proxy intercepts authentication requests, communicates with the OIDC provider, and modifies the authentication tokens to include tenant information. This allows the application to continue using standard OIDC flows while the proxy adds multi-tenancy capabilities by injecting tenant identifiers into the token claims, thus resolving the contradiction between ease of authentication offloading and multi-tenancy support.
2Reliability
If legacy applications are used, then existing systems can be maintained, but they cannot access specific tenant information for scaling
Solution Approach 1:
The authentication proxy serves as a mediator that allows legacy applications to access tenant information without modification. The proxy enhances the standard OIDC token response by adding custom claims containing tenant identifiers and tenant-specific data. Legacy applications can then access this information through the enriched token, enabling scaling capabilities while maintaining compatibility with existing systems.
Solution Approach 2:
The solution modifies the authentication token parameters by adding custom claims and extensions that contain tenant information. The proxy changes the token structure to include additional fields such as tenant_id, tenant_name, and other tenant-specific attributes. This parameter enhancement allows legacy applications to retrieve tenant information without requiring fundamental changes to their authentication logic.
Data Source
AI summary
In one embodiment, a method comprises accessing information associated with a user that is trying to login to an application, generating a first session identifier corresponding to the information, sending a first notification to an authentication client that the user is trying to login using an authentication service, receiving a first request from an authentication provider for authenticating a second session identifier, determining that the second session identifier is identical to the first session identifier by comparing the second session identifier with stored first session identifier, and causing the authentication provider to patch one or more authentication tokens with the information regarding the tenant, where the one or more authentication tokens are used for accessing the application.