How to associate clients with a tenant and manage Multi tenant solution

[sagarshah1983]

We are working on cloud based solution in which we need oauth clients to be managed for multiple vendors/facilities/tenants.
However, access token obtained by the client should work and allow access only for the resources that are specific the the facility/tenant for which client is created.

Can this be supported using hydra? What's the best approach to create client and associate with a tenant and make sure that access token is limited to only that facility/tenant? Are there any plans to handle this in newer versions?

Appreciate your thoughts!

[vinckr]

It sounds like you would best handle this with some kind of permission server, for example ORY Keto.

There is currently a major overhaul for Keto going on, you can check out some progress on the first "next gen" version.
This new version will implement Googles Zanzibar paper.

A usecase like you described is already possible with ORY-flavored Access Control Policies, but I would recommend waiting for the next stable version. We roughly estimate that it will be out by Q1 2021.

[sagarshah1983]

Thanks a bunch for prompt reply here! I will take a look at keto!

[aeneasr]

To expand on @vinckr answer - it also depends a bit on context. If you want to have one database per tenant, and one configuration per tenant - so completely isolated systems - you will have to deploy one instance of hydra per tenant with separate configs.

If you only want certain clients to be able to access certain resources, then ORY Keto can definitely help. You can also take a look at access token audiences if you don't want a full-blown permission system.

To conclude - if you want completely separate "installations" you need to deploy one hydra per install. If you have some shared state (e.g. shared config and shared database), then something like access token audiences or permission management should be sufficient.

[sagarshah1983]

Thanks for recommendations @aeneasr . That helps. We are going to have about 200-400 such tenants so separate install and database option won't really work for us. but I can try to look at options on setting token audience for now and later look at keto to understand acl and implement fully managed permissions. Is there some documentation around limiting using audience claim in access token?
Again, appreciate your help!