SSO for Multi-Tenant SaaS (same user base among tenants)
Does any platforms have Multiple Tenants with same overlapping user base?
Consider a platform where multiple developers register with it, get the api keys and build an app from it.
These multiple tenant apps will be released to the market. Users can download those apps and login into any of these apps.
Considering this scenario, How one can achieve an authentication system by allowing a user to login via social networks (like Facebook or Google).
Example : A user logged into Tenant-App-1 should be able to quickly login to Tenant-App-2 as well with the same profile shared among these apps. And platform has unique user identifier for identifying this user.
What is the usual practice to achieve such kind of login system?
Update : Changed title from Social Login to SSO - Thanks to @rab
It's called "single sign-on". Look that up.
Yes. Thats the right one but how xan we implement it?
Do we need to have a single Facebook App for the platform and pass the api keys to the tenant apps?
What are the ways to do that?
I assume users authorise use of their credentials by your single facebook app and your tenant apps proxy authentication off that. Surely tenant apps just need a valid api key recognised by your facebook app.
May have trust issues if tenants & facebook app are on different domains unless you position the app as a "trusted identity provider" to your users.
You mean single facebook app id for whole platform right? Or each tenant need to create a facebook developer app?
Single app id for whole platform. Not an expert but could see that working in theory. Your app would be an authentication service for your tenants. Users of your tenant apps would have to sign-up to your Facebook app first though. There may be a pinch point that makes it unworkable. Would it be right approach for you? Sorry but cannot say.
Currently platform handles the authentication for the users logged in through the tenant apps. But i'm not sure on the secured approaches for sharing the facebook api key. If you have any info please let me know.
You need to build an IDP service (Identity Provider) that acts as an authentication/signup for users (IDP can be multi-tenanted too).
You App1 will need to have a trust established with your IDP.
You IDP will be responsible for providing Login with FB, etc functionality.
After logging into IDP, redirect your user to whatever App they came from.
This way you can have multiple apps (app1, app2) that trust a single IDP that handles authentication and sends your profile information to the app1, thereby achieving SSO
Thanks a lot for the info. Do you have any online tutorial or more notes on this? If so please share it.
Okta and Auth0 support mult tenant SSO. Both offer free dev accounts too. Once you've got it worked out you can use any provider you want just by changing the settings.
By the way, "social login" is called "Open ID Connect" or OIDC, and you most likely want to use the Authorization Code Flow. Note also that the "implicit flow" is typically insecure and no longer recommended, but there's a ton of articles out there that use the implicit flow.
If you think you need the implicit flow use the Authorization Code Flow with PKCE instead.
Thanks for the details.
If I need to implement without third party, how can I achieve this?
Facebook App ID created for my platform can be shared among tenants to let their users login? This makes all the users of any tenant app bounded to my single platform. But what questions i have are
You can do this out of the box with Rails, Devise, and ActsasTenant.
Do we need to create a single Facebook app and share it with the tenant apps ? Is it a secure approach?