Multi-tenant authentication for products with many business customers
Multi-tenant authentication is sign-in for a product that serves many customer companies from one deployment, where each company needs its own members, its own roles and often its own single sign-on. The Skycloak Platform is built for this shape of product, from the database up.
The problem a single user list cannot solve
Most products start with one list of users and a column that says which company each one belongs to. That works until a customer asks for its own admin who can invite colleagues, roles that mean something different in their company, SSO through their identity provider, or the same person belonging to two customers at once, as consultants and agencies often do.
At that point the company column becomes a permission system written by hand, and every query in your product has to remember to filter by it. One forgotten filter is a data leak between customers.
Organizations inside your tenant
On the Platform, your product is a tenant and each of your business customers is an organization inside it. Organizations, roles per organization and enterprise SSO over SAML are on the Platform's plan. Each organization has its own members and its own roles, and a user who belongs to two organizations signs in once and picks the one they are working in.
Inbound SCIM is planned too: a customer's IT team manages its people in Entra, Okta or any SCIM 2.0 directory, and each organization maps its directory groups to its own roles. The token your application receives names the organization and the roles, so your code checks one claim instead of building its own membership tables.
Isolation enforced by the database
The Platform itself is multi-tenant in the same way. Tenants are kept apart by row-level security in PostgreSQL: every table is filtered by tenant in the database, and the engine connects with a role that cannot switch that filter off. A bug in the code above the database cannot read another tenant's users.
Each tenant runs in the United States or the European Union, fixed when you create it. We describe a feature as available only once it has shipped, so a demo is where you see which parts of the plan you can use today.
Frequently asked questions
Is a tenant the same as one of my customers?
No. A tenant is your product, or one environment of it. Your customers are organizations inside that tenant, each with its own members, roles and SSO.
Can one person belong to several of my customers?
Yes. A user can be a member of several organizations in your tenant and chooses which one they act in after signing in.
See the Skycloak Platform for yourself
Book a demo and we will walk you through the Platform with your own sign-in flows in mind.