Open-source multitenant solution 

This part of the book focuses on open-source for multitenant solution providers. Multitenancy goes deep to all levels of the infrastructure: front-end, middle-tier and backend. It might be easier to implement it in open source if we visualize it in two layers – the data plane layer and the application plane. 

The Data plane layer is all about data at rest and transit. Often, this involves partitioning on the data layer with separate partitions, tables, columns, identifiers and labels on the data storage schema and topics such as in Kafka, tags, domains and other data. 

The control plane layer is about context and access over the data and resources and primarily deals with organization, namespace and metadata. It secures and maps the users to the tenants via the Authorization component that can include an external Identity provider or an IAM solution. Many open-source infrastructures provide abilities to delegate IAM access to others. 

An authorization layer alone can convert a single tenant application into a multi-tenant solution where only the accesses are separated over the infrastructure as a whole taken as a resource. This works like an upgrade to the original infrastructure. The right policy model can simplify this transition even better. Policies can include role-based access control with tenant management, relationship based access control over a hierarchy where tenants become root-level relationship or attributes based access control with tenancy as an attribute. While role-based access control is the default policy model sought widely, relationship-based access control can help describe complex relationships between resources in a system. This approach facilitates a “policy-as-a-data” realm as opposed to “policy-as-a-code” realm. The policy is split between declarative rules and logic and can be visualized using a relationship graph and a hierarchical structure for assets such as folders and documents. Hierarchy can help with inheritance.

Attribute based access control emphasizes the use of attributes associated with the subject, the resource or the environment to determine whether access is granted or not. This results in a fine grained authorization model and when these attributes have dynamic values, there is a lot of flexibility achieved. Databases implement row-level security so this has some precedence. Authorization models can also be combined. 

Multi-tenant authorization does not need to be implemented from scratch. Often there is an existing library, product or solution that can be integrated into the Software-as-a-service. If it must be implemented, there are multiple options. Open Policy Agent (OPA) can be leveraged as an authorization microservice. Open Policy Administration Layer (OPAL) enables one to manage the authorization layer at scale, using PubSub topics and json data. Solutions like Permit.IO provide a way to integrate seamlessly for tenants.