multitenant | making cross tenant data leaks a thing of the past | Application Framework library
kandi X-RAY | multitenant Summary
kandi X-RAY | multitenant Summary
When building multitenant applications, never let an unscoped Model.all accidentally leak data to an unintended audience.
Support
Quality
Security
License
Reuse
Top functions reviewed by kandi - BETA
- This method is used for creating a relation to create a new tenant .
multitenant Key Features
multitenant Examples and Code Snippets
Community Discussions
Trending Discussions on multitenant
QUESTION
I'm developing multitenant app in ASP.NET Core using Azure AD as authentication. I want to allow access to my app only for specific tenants (due to this I added valid issuers list to my app authorization).
Problem is I want to specify custom roles for each tennant. Why? Base scenario looks like this.
I have customer organization (Tenant) A with 3 departments named AB, AC and AD.
Meanwhile I have customer organization (Tenant) B with 5 departments BA, BB, BC, BD, BE.
I want to be able to grant users permissions excatly for their departments. For example grant user from tenant A access only to department AB (or all of them) and in perfect scenario it will be done by admin of company A in their Azure AD.
I was thinking of App roles from Azure AD but it seemed to me a very undesirable to expose in manifest all departments of all my customers.
...ANSWER
Answered 2022-Apr-04 at 09:47Please refer this official doc first:
Add app roles to your application and receive them in the token
The permissions function of Azure AD is not yet specific to the departmental permissions of the tenant.
This official document tells me that when we are in App Registration, we can add an App Role to other tenants (Test), and then our application can be accessed by the Test tenant.
However, the specific permissions for each department under each tenant should be controlled at the code level.
QUESTION
Right now, I have MS Teams Bot running under App Registration configured to use "Accounts in any organizational directory (Any Azure AD directory - Multitenant) and personal Microsoft accounts (e.g. Skype, Xbox)".
To begin with, I did a research on that topic and I am writing this question having in mind following resources:
- Comment on issue #9498 @ azure-sdk-for-net
- Azure Bot App Registration requiring multi-tenancy when single-tenant is prefered
- Bot Framework - App registration - Single tenant vs Multi tenant
All these answers, from my understanding, comes to this:
- prior to late 2021 only Multi-tenant apps as bot identity were supported
- now I should be able to use the Single-tenat for app registration, but that requires additional configuration
- moment when mentioned changes are in effect is a moment when Bot is trying to authenticate
As other bots imperatively (explicitly) authorize using ex. MicrosoftAppCredentials - MS Teams Bots have their authorization details configured declaratively in XML files like appsettings.json in bot service.
How can I use Single tenant App Registration with Azure Bot used in MS Teams? Or is it not possible currently?
EDIT:
For future reader: using the answer, I prepared two places where you can access TenantId of incoming activity to perform whitelisting validation (in Multi-tenant setup, because Single-tenant is still not working on Teams):
- In
BotController:
ANSWER
Answered 2022-Mar-31 at 11:01I ran into this with another user on this site recently, where Proactive Messaging would not work because they had selected Single Tenant. It's a recent option, and it seems broken from my research - I would go with the MultiTenant option. If you really need to block the bot from being accessible from other tenants (which could well be recommended as it's possible for a bot to be access by any user in any Teams tenant, it might be best to white-list your Tenant Id(s). There's an old sample on how to do this here - haven't tested if it's still working: https://github.com/OfficeDev/microsoft-teams-sample-complete-csharp/blob/master/template-bot-master-csharp/middleware/Middleware.cs
QUESTION
I am building Web API backend for multitenant, .NET 6 based, application and I have encountered an architectural problem which drives me crazy since last couple of weeks, so I would much appreciate ANY hints and advices.
Whole solution is build in classic Clean Architecture (layers: API, Domain, Application, Infrastructure, Shared), which was't the greatest idea I suppose, but I'm affraid it is irreversible by now. Anyway, I would like to make an effort to save all I have created so far.
In the application I have 2 databases (with Entity Framework in the code behind):
Database A: Tenant users scope - with TenantId field in each table for RLS mechanizm implemented on the SQL level to prevent inter-tenant data leaks
Database B: Internal users scope - no RLS mechanism
The problem is both databases share great amount of common structures and logic.
Simplified example of current models (both database and domain):
Database A:
ANSWER
Answered 2022-Mar-23 at 11:06This way I'm creating a lot of code duplication. I do not want to create common interfaces for those classes because I think this may kill the application's development in some point in the future (Models may become a little bit different anytime).
If you have too much duplication, you are right in thinking you should merge your code. If both model should be able to have common code, and specific code, then the solution to your problem is probably polymorphism.
I would suggest to have two new classes Domain.TenantEmployee and Domain.InternalEmployee both inheriting from an abstract Domain.Employee. You can put common behavior in the parent class, and specific one in the child ones.
Then your infrastructure layer can convert Domain.TenantEmployee from/to DatabaseA.TenantEmployee and Domain.InternalEmployee from/to DatabaseB.InternalEmployee.
QUESTION
I have an Azure Bot installed in my organization through Teams. Interactions with the bot are properly functioning.
We have a scenario where we need to send notifications to our users from an external process (C# app running in Azure).
I attempted to use the Bot Framework REST API to create a conversation with a user in order to then message them with the notification as outlined here
This scenario does not work as I cannot get an access token for a bot that is not using the global Bot Framework Tenant. Our Bot is installed on our Azure tenant as a SingleTenant BotType so I get the following error:
...ANSWER
Answered 2022-Mar-20 at 19:40Proactive messaging is definitely what you're looking for, but there are a few important things to be aware of. Here is a sample https://github.com/pnp/teams-dev-samples/tree/main/samples/bot-proactive-messaging that will hopefully be useful - I included both a C# and a Node version as well as some links to further reading, and here is a link to a video session where I talk more about the concept: https://www.youtube.com/watch?v=mM7-fYdcJhw&t=1398s.
In simple terms, remember that Bot Framework can be used in many contexts, Teams is just one of those. Importantly, unlike other contexts, when you're in Teams there is no concept of "creating" a conversation with the user. There is only ever a single "conversation", and you are basically "continuing" the conversation. As a result, you want to call continueConversation. In the same sample I linked above, here is the relevant line. Under the covers, this is indeed calling a REST API, but wrapped like this it's easier.
As the sample shows, however, because you can't start a conversation, and can only continue one, you need to make sure you have the conversation context already, and that may also mean ensuring that the user has the bot installed already into the personal context (which is what actually does start the conversation). Here is where that happens in the sample.
If your users have the bot installed already, then its just a case of storing the conversation context like I show in the sample. If not, and you want to learn how you can pre-install the bot, see this question: Proactively Install / Push Apps in Teams for Multiple Users
QUESTION
I'm using the default Blazor Server Template in Visual Studio 2022 with the authentication set to use the Microsoft Identity Platform.
I have an AppRegistration in my Azure Active Directory account set to allow accounts in any organization (Multitenant):
In my appsettings.json file I am using the correct client & tenant id:
When I run the application I can log in with any account that is in my AAD tenant (or has been invited into my AAD). However when I try to use an identity from another AAD Tenant I get the following error:
Selected user account does not exist in tenant 'TENANT NAME' and cannot access the application 'APP-REGISTRATION-ID' in that tenant. The account needs to be added as an external user in the tenant first. Please use a different account.
From what I have found in the docs and other articles I need to be using the common endpoint for logging in, but if I change the "Domain" in my appsettings to "common" it does not make a difference and if I update "Instance" to https://login.microsoftonline.com/common/oauth2/authorize or https://login.microsoftonline.com/common/ I get an exception as the URL is not correct.
Perhaps the default Blazor Server Template is set to use Single Tenant app registrations? How can I have it properly use Multitenant?
...ANSWER
Answered 2022-Mar-20 at 04:33Based on the selected supported account type, you have to change the value of TenantId in appsettings.json file.
For Single-Tenant account type, it should be "
your_tenant_id"For Multitenant account type, it should be "
organizations"For Multitenant and personal Microsoft accounts type, it should be "
common"
As you have selected "Accounts in any organizational directory (Any Azure AD directory - Multitenant)", please check by changing your appsettings.json values like below:
Your TenantId value must be organizations and your ClientId value must be your_application_id.
Please check your Domain value. You can find your domain here in your Azure AD overview page:
Make sure to include CallbackPath from your appsettings.json file in Redirect URI of your application to avoid redirect URI mismatch error.
Please find below references if they are helpful.
QUESTION
I'm having trouble getting any of the Application ID URIs working. I have a Blazor WebAssembly Hosted application, written in ASP.NET Core 5.0. Using the api:// format is fine, but this doesn't play well with Terraform. I can get my client talking to the server using api://, so I know the code is working fine. When I swap the Application ID URI to use any of the other formats, such as https:/// or api:///, I get a 401 error. I'm using a verified Azure AD domain.
I can see that means, "The string value for the host or the api path segment.", but I'm not sure what that means. I've been testing with set to the name of my App Service and also the name of the App Registration. I've also tried changing the App Registration from Single Tenant to Multitenant (just in case that makes a difference).
Any advice would be much appreciated.
...ANSWER
Answered 2022-Mar-11 at 04:41For anyone stumbling upon this, the solution is to make sure to include the Audience within the AzureAD block in appsettings.json.
QUESTION
I have created a webapp on Azure and have set the authentication mode to;
"Accounts in any organizational directory (Any Azure AD directory - Multitenant) and personal Microsoft accounts (e.g. Skype, Xbox)
All users with a work or school, or personal Microsoft account can use your application or API. This includes Office 365 subscribers."
It works perfectly for me and my colleges, and it works also for personal Microsoft accounts.
I am now trying to login users on a different Azure AD, but these cannot login. Here is the login log of an attempt taken from their AD. A similar message was displayed to the user onscreen
User account '{email}' from identity provider '{idp}' does not exist in tenant '{tenant}' and cannot access the application '{appId}'({appName}) in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account.
the sole purpose of the webapp is to get an Azure/MS verified email address of the user and perform a lookup in a user database.
Preferably this should be achieved without need the "other azure AD" admins to do anything on their end. But if need be this can be asked. I just don't know what to ask.
...ANSWER
Answered 2022-Mar-10 at 08:09User account '{email}' from identity provider '{idp}' does not exist in tenant '{tenant}' and cannot access the application '{appId}'({appName}) in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account.
This error usually occurs for many reasons. Please check if below are helpful:
Case1:Please check if your sign-in URL is something like this:
QUESTION
I am trying to write custom api log handler for wso2 apim (4.0.0) so that it should add correlationId, request payload and response body when certain api is called. I followed the answer to similar question. So far I have done following:
...ANSWER
Answered 2022-Mar-09 at 14:21The correlation ID is generated when Observability logs are enabled in the API Manager server.
Therefore, to get the correlation-id printed in your logs, you have to enable the observability logs as instructed in here. You can get more insights about the observability logs and correlation IDs in the official Docs.
QUESTION
Let's say I have a company of 100 employees/users in its Azure AD Premium P1. This company has 100 monthly active external users in its Azure AD. This company has some SaS multitenant applications(app registrations) which are used by 1000 monthly active users from different companies who have their own Azure Ad subscription.
For 100 users from the company's Azure AD Premium P1 applies pricing $6 per user/month. For 1100 users(100 externals and 1000 from other Azure Ad subscriptions who use the multi-tenant apps) apply the MAU pricing - First 50,000 MAU $0/Monthly Active Users.
Am I right?
...ANSWER
Answered 2022-Jan-31 at 10:26I'm quite sure that you don't pay anything for the users that are not represented as users in your tenant. Only for the ones that sign in against your tenant. If you publish a multi-tenant app, those users will log in against their Azure AD tenant.
On the other hand if you have an internal application (single-tenant) and you also allow partners to access it, those would count as external users in your tenant.
QUESTION
I am trying to build a signin solution for a multi-tenant Web App.
I have more or less created a solution based on the B2C Multi Tenant sample provided by Marius Rochon here: https://github.com/mrochon/b2csamples/tree/3823c17def460f154e4bf4a74b2a8b8b7c14fc2e/Policies/MultiTenant
This solution relies on "Tenant Selection" in the query string, and then the backend API populates the "appTenantName" based on the query parameter.
What I would really like is a solution where, after the initial login, the user is prompted to select one of the available tenants, in a dropdown based on the "allTenants" claim (an array of strings).
Alternatively a solution where the tenant selection is based on the subdomain part of the site the user is trying to login to.
I have limited experience with the custom IEF setup, so I am uncertain if what I want is even possible.
I can see that its possible to define user input and a fixed "enumeration" for available options, but I guess I want a "dynamic" enumeration based on the claims. Is that even possible?
Or should I do custom UI content instead and load the UI from my own website (like described here: https://docs.microsoft.com/en-us/azure/active-directory-b2c/customize-ui-with-html?pivots=b2c-custom-policy
...ANSWER
Answered 2022-Jan-24 at 17:19If you want to dynamically populate a drop down box, based on some array of strings that you generate during the policy execution, here is a sample.
Community Discussions, Code Snippets contain sources that include Stack Exchange Network
Vulnerabilities
No vulnerabilities reported
Install multitenant
On a UNIX-like operating system, using your system’s package manager is easiest. However, the packaged Ruby version may not be the newest one. There is also an installer for Windows. Managers help you to switch between multiple Ruby versions on your system. Installers can be used to install a specific or multiple Ruby versions. Please refer ruby-lang.org for more information.
Support
Reuse Trending Solutions
Find, review, and download reusable Libraries, Code Snippets, Cloud APIs from over 650 million Knowledge Items
Find more librariesStay Updated
Subscribe to our newsletter for trending solutions and developer bootcamps
Share this Page
