Elsa 3 Multitenancy — Option to Disable Tenant Validation (Allow Unregistered Tenants)

[Narenderdhamarlapaly]

Currently, Elsa 3’s multitenancy system enforces that every resolved tenant must exist in the configured tenant provider (either ConfigurationTenantsProvider or StoreTenantsProvider).

In some scenarios—especially for dynamic or SaaS-style multi-tenant systems—we may want to accept arbitrary tenant IDs (for example, passed through headers or routes) without requiring that they be pre-registered in the tenant store.

However, unlike Elsa 2, there is no ValidateResolvedTenant option or equivalent mechanism in Elsa 3’s MultitenancyOptions to bypass this validation.

Use Case:

We are building a multi-tenant SaaS system where:

The tenant ID is sent from the client via a header (X-Tenant-Id).

Tenants are created and managed dynamically in another service.

Elsa should still load workflows and execute them in the tenant context, even if the tenant record is not yet persisted in Elsa’s tenant store.

In Elsa 2, we could disable this validation using:

options.ValidateResolvedTenant = false;

But in Elsa 3, this option no longer exists.

Expected Behavior:

Elsa should allow resolving and using a tenant context even when the tenant does not exist in the configured ITenantsProvider.

For example, the following configuration should not throw an exception when the tenant is not found:

elsa.UseTenants(tenants =>
{
tenants.ConfigureMultitenancy(options =>
{
options.TenantResolverPipelineBuilder.Append();
// ✅ Expected: Allow arbitrary tenants without validation
// options.ValidateResolvedTenant = false; (missing in Elsa 3)
});

tenants.UseStoreBasedTenantsProvider();

});

Actual Behavior:

Elsa currently fails when a tenant ID is resolved but not found in the store, throwing an exception similar to:

Unable to resolve tenant from provider 'StoreTenantsProvider'.

Proposed Solution:

Add a configuration flag in MultitenancyOptions, for example:

public bool ValidateResolvedTenant { get; set; } = true;

If false, Elsa should skip tenant existence validation and continue executing workflows under the resolved tenant ID.

Environment:

Elsa version: 3.3.0

.NET version: .NET 8

Database: PostgreSQL

Multitenancy setup: StoreTenantsProvider with HeaderTenantResolver

[sfmskywalker]

Short answer: Elsa 3 does not currently have a ValidateResolvedTenant-style switch, and the current pipeline assumes that a resolved tenant ID must map to a Tenant returned by the configured ITenantsProvider.

In the current code:

• MultitenancyOptions only exposes TenantResolverPipelineBuilder; there is no bypass/validation flag there.
• DefaultTenantResolverPipelineInvoker first loads tenants from ITenantsProvider.ListAsync, builds a dictionary, runs the resolver pipeline, and only returns success if the resolved tenant ID exists in that dictionary. If it does not, it logs a warning and returns null.
• TenantResolverContext also only resolves against that provider-backed tenant dictionary.

Relevant source:

• elsa-core/src/modules/Elsa.Tenants/Options/MultitenancyOptions.cs
• elsa-core/src/modules/Elsa.Tenants/Services/DefaultTenantResolverPipelineInvoker.cs
• elsa-core/src/modules/Elsa.Common/Multitenancy/Contexts/TenantResolverContext.cs
• elsa-core/src/modules/Elsa.Common/Multitenancy/Contracts/ITenantsProvider.cs

So for a SaaS-style setup, the supported extension point today is not a validation toggle on the resolver. The supported path is to make your tenant provider authoritative for those tenants, e.g. a custom ITenantsProvider (or UseTenantsProvider(...)) that surfaces tenants from your external tenant system. A header resolver by itself is not enough, because resolvers only return tenant IDs; the pipeline still expects a matching Tenant object from the provider.

So I do think the gap you identified is real, but based on the current implementation I would frame it as a feature request against the pipeline/invoker model rather than a missing configuration knob on existing resolvers.

Related:

• Elsa 3 Multitenancy — Option to Disable Tenant Validation (Allow Unregistered Tenants) #6987 tracks the same request in issue form.