Handling Multi Tenancy on MVC

Question

I would like to ask your opinions regarding the way I handle MultiTenancy. I"m using MVC3 (switching to MVC4) and EF as my backend. I'm using a single app, shared schema MultiTenancy. Below is the code:

public abstract class Service<T> where T : Entity
{
    private Repository<T> _repo;
    public Service()
    {
        _repo = new Repository<T>();
    }

    public bool Authenticate(int id)
    {
        //var companyInfo = _authorizationRepository.GetApiKey(apiKey);
        int tenantId = 0; // replaced by companyInfo using repository
        var entity = _repo.GetQuery(tenantId).Where(e => e.Id == id).First();

        if (tenantId != entity.TenantId)
            throw new ArgumentException();

        return true;
    }
}

public class EmployeeService : Service<Employee>
{
    private EmployeeRepository employeeRepository;
    public EmployeeService()
    {
        employeeRepository = new EmployeeRepository();
    }

    public Employee GetEmployeeById(int employeeId)
    {
        this.Authenticate(employeeId);
        return employeeRepository.GetById(employeeId);
    }
}

public class Entity
{
    public int Id { get; set; }
    public int TenantId { get; set; }
}

Of course DI will be there as well but for simplicity I removed them here (temporarily). I used Generics (feeling dirty about it) on the Service Layer since I'm having trouble on comparing the TenantId with the correct Entity that will be passed on the class. I'm eyeing to recode this using FilterAttributes but I dont have any idea how to. How do you guys handle your multitenancy? Is the design have some crucial flaws that I may encounter on the long run? If you have some samples using FilterAttributes that would be a big help.

Thanks!

Answer 1

We are building pretty big multi tenancy web app at the moment. Well it's not so simple as it seems but once you build your architecture it's straight forward. Our is deeply in development but you can check out the open source part in nanocms.codeplex.com (we haven't uploaded the db jet butt we will in few days)

Since this is a pretty wide question I'll try to summarize some problems and solutions.

First you need to identify tenant for each request. We have a global action filter that parses url and compares it with data in database. Of course you must cache all data so no calls to database are made. You must not save any of that in a cookie or session because user can visit more than one tenant at the time. I suggest that you put that data in HttpRequest Items so you do that only once in a request but still have that data available always.

For authenticate users must be unique. You must think if you want to give some user different rights on each tenant. If so you must write your authenticate code and even attribute so you can check his role in current tenant. In our app when user authenticates we create session object. In object we have static methods that check for rights in tenant.

I suggest you keep HttpRequest Items strongly typed. We have:

public static int TenantID {
    get { return System.Web.HttpContext.Current.Items.Contains("TenantID") ? Convert.ToInt32(System.Web.HttpContext.Current.Items["TenantID"]) : -1; }
    set {
        if (!System.Web.HttpContext.Current.Items.Contains("TenantID"))
            System.Web.HttpContext.Current.Items.Add("TenantID", value);
        System.Web.HttpContext.Current.Items["TenantID"] = value;
    }
}