tenancy | No code changes | Authorization library

I've taken over a project from a prev dev, and I'm trying to understand the tenancy for laravel package, we've past the point of no return on the project to use a new package and to be fair the package and domain is working well for the created subdomain put in by the previous dev, but when I use tinker to create a new tenant and domain, as described in the quick start doc, tinker creates the db, creates the domain and tenant but it seems to fetch a migration file from one of the subdomains too? Anyone every came across this before?

Need help to understand standard flow for handling additional-information-required scenario.

Context: We have a number of product implementations, all integrated with a central single sign-on server. A registered customer can opt to start using new products on-demand. But some of the products require the customer to carry out some one-off setup steps before they use the product - these steps are only needed the very first time of using the product.

Consider a customer is on the page https://product-abc.ourdomain.com. And now clicks on a link within that product something like 'do something (note, this will redirect you to product-xyz)'. At this point the customer is redirected to https://product-xyz.ourdomain.com. Here we want to detect whether the customer is using the product for the first time and if yes, redirect the user to a setup page wherein we can prompt them to supply the product-specific additional information. On the other hand, if the customer is already configured for the product, they will just navigate into the product page and continue using it.

I wanted to know if there is something similar to the 401 Unauthorized flow to handle this. With authentication flow,

• A client tries accessing a protected resource.
• The server checks the caller has requisite authentication and if not, returns 401 Unauthorized status code with additional details in the WWW-Authenticate header.
• The client carries out authentication - say by integrating with the central single sign-on server - and then reattempts the original request, this time succeeding.

I'm wondering if there is a similar flow like,

• A client tries accessing a protected resource.
• The server checks whether the client is OK to use it. In our case, if its the first time a customer is accessing the product, this check will determine additional setup is required. For example, the client has to supply us with their correspondence address so that we can set up a data tenancy for the specific customer. Here I would like to return a HTTP status code, say, 4xx Setup Required with additional information in a header, say, WWW-SetupInfo.
• Once the initial-setup flow is completed, the customer will be redirected to the main product and carry on using it.

The nearest status code that seems to match my usecase is 402 Payment Required, but product-xyz doesn't need any specific subscription or payment. We just need some product-specific additional information to do the initial configuration.

I can handle it by doing custom implementation using 3xx redirect but I was wondering if there is a better way of handling it.

Thanks for any pointers.

My app.py file

In a multi-tenant ABP MVC app, there is a built-in endpoint to list users:

GET: /api/identity/users

This endpoint only shows users belonging to the Current Tenant.

Is there a way to ignore the multi-tenancy filter as the 'host admin', to list all users, across all tenants?

Similarly, can the 'host admin' create/ modify/ delete users in other tenants via the same api/identity/users endpoint?

Or is writing a custom endpoint the only way?

Terraform is creating role and attaching it to the EC2 instance successfully. However, when I try to run commands with aws cli, it is giving error with missing AccessKeyId:

aws ec2 describe-instances --debug

I have an OCI provider for my Terraform script:

I'm new to AWS and it's services. What I want to achieve is a multi-tenancy SaaS application. What my concept looks like: I use Cognito for user authentication. There all users no matter what tenant they belong to should use one frontend to login. For the tenant-recognition I use a custom attribute "custom:tenant" which I get from the JWT when the login is successful. For the applicantion itself I want to use VPCs and to ensure encapsulation each tenant should have their own VPC.

Example:

• User A of Tenant 1 login and gets back JWT with claim "custom:tenant":"1" should be routed to VPC 1
• User B of Tenant 2 login and gets back JWT with claim "custom:tenant":"2" should be routed to VPC 2

Now my question is: how do I achieve this routing from the success of the login to the appropriate VPC? Do I need further Services for that or where do I find these settings?

We do schema-based multi-tenancy in our Postgres DB. Each and every schema is associated to a different tenant and will have the exact same structure except for one schema named public.

To obtain the list of all the relevant schemas, we can use:

We are using Airflow 2.1.4 and running on Kubernetes.

We have separated pods for web-server, scheduler and we are using Kubernetes executors.

We are using variety of operator such as PythonOperator, KubernetesPodOperator etc.

Our setup handles ~2K customers (businesses) and each one of them has it's own DAG.

Our code looks something like: