1

I've already implemented multi tenancy in Parse, by (1) creating tenant-specific roles (each time a new tenant is created) and (2) assigning them to the ACLs of the objects/records/rows related to the tenant on any given table.

I wonder if it is the same (role-based) logic on Backand and how is it should be implemented.

Any example or pointer to examples would be great.

marco alves
  • 1,707
  • 2
  • 18
  • 28

1 Answers1

3

The role based security in Backand that will help you to build a multi tenancy app, consist object level security and predefined filter. The predefined filter is important for multi tenancy. It allows you to use the same object for different tenants and to filter the data so each tenant will be isolated. The predefined filter is either a NoSQL or SQL statement that always run in the server and filter the data. In Backand you can automatically create a statement that will filter only the data that the requesting user created. You need to make sure that all the objects are related to the users object so such filter statements will work. Here is an auto generated NoSQL example that filters all the items for a specific user, unless the user has an admin role:

{
  "$or": [
    {
      "'{{sys::role}}'": "'Admin'"
    },
    {
      "user": {
        "$in": {
          "object": "users",
          "q": {
            "email": {
              "$eq": "'{{sys::username}}'"
            }
          },
          "fields": [
            "id"
          ]
        }
      }
    }
  ]
}

Here is the same as SQL:

( 'Admin' = '{{sys::role}}') or (`items`.`user` in (select `users`.`id` from `users` where `users`.`email` = '{{sys::username}}'))

You can edit this statement so it will filter for what identifies a tenant in your app.

You can this with each of your objects. This is located in the security tab of the objects. enter image description here

relly
  • 439
  • 3
  • 3
  • The part of {{sys::role}} and {{sys::username}} is somewhat missing on the docs. The example in the docs only shows Admin='(blank)' and email = '(blank)'. I wonder if it is due to Angular interpolation that is evaluating the "sys::" expressions to `undefined`. – marco alves Mar 14 '16 at 10:29
  • Thanks for the feedback we had a glitch in the docs generator - fixed now. – Itay Mar 15 '16 at 12:46