Multi-Tenancy - Security

Radzen Studio Blazor Server
1

I am trying to understand the purpose of having different Roles for different tenants. The issue is that based on how security is designed, roles access is applied at the application level....not the tenant or user level. In addition, if I have a role name "Admin" in both tenants, it may mean something different in the other tenant.

At an even higher level of application security design, what happens when an enduser/admin adds a new role...it really doesn't mean anything because the role was not implemented in the application.

Any suggestions that you all have already done?

If none, would anyone be interested in collaborating on developing a solution?
I am suspecting that Radzen will need to change/add the flexibility to allow the IDE to specify a custom AuthorizeAttribute.

2

Roles and users are per tenant.
Each tenant is like separate application instance with security and with its own users and roles.

3

Yes, but you have to set authorization at the code level....so how do you know what roles to create for the authorizations to work?

4

You set authorization per page and Radzen generates the relevant code. The roles are listed:

image
image3840×2160 500 KB

5

To me...that is still at the code level whether it is generated or hand coded...What happens when the user creates a new Role? The application has to be regenerated to support the new role. Design time vs. Run time.

6

Yes, the application should be regenerated. This is how Radzen security works.

7

This is how ASP.NET security works - via code. One has to specify the role names either via AuthorizeAttribute or a custom policy. We don't know of any way around it.

8

So what I am suggesting is if anyone is interested in collaborating on building a custom policy security framework so that you can apply security at runtime.

9

This stackoverflow question sounds similar: c# - Loading ASP.Net Core authorization policy from database - Stack Overflow and could give some tips for a possible custom implementation.

Radzen allows you to apply a custom policy via the Page properties:

image
image1034×820 30.8 KB

1 Like