Skip to main content

Understanding and Configuring a Tenant ID for Your Data Pool

This guide explains when and how to select the appropriate tenant ID column for your Data Pool.

It covers when to use tenant IDs in Data Pools, how access control works with tenant IDs, how to select the appropriate tenant ID, and how to control access for your multi-tenant applications.

  1. When to use the Tenant ID in Data Pools
  2. How access control works with Tenant IDs
  3. How to select the appropriate Tenant ID column
  4. How to control access for your multi-tenant applications

Requirements​

When to use the Tenant ID in Data Pools​

You should use the tenant ID feature when building multi-tenant applications. A multi-tenant application is a software application designed to be used and shared by multiple users or user groups, referred to as "tenants". These tenants can be organizations, business units, teams, or even individual users, each with their own data and configuration. Every B2B SaaS product or consumer app is a multi-tenant application.

Multi-tenant applications require additional access control capabilities because of two unique requirements:

  • The tenants must only be able to access their own data.
  • The application must support potentially millions of unique tenants.

How access control works with Tenant IDs​

When creating a Data Pool, you can optionally specify a tenant ID. This is a pointer to a specific column which will be used to control access to the data. For example, a customer_id column can be used as the tenant ID.

Once specified, you can then assign tenant-level access policies to your Metrics. When querying a Metric, Propel will only return values for a specific tenant. You specify the tenant ID when creating an access token. That way, the tenant ID is bound to the token and cannot be modified from client-side code.

How to select the appropriate Tenant ID column​

The tenant ID should be your most granular identifier of tenancy in your application. It could be a customer_id or organization_id for B2B applications or a user_id for consumer applications.

How to control access for your multi-tenant applications​

To set up a Metric with a tenant-level access policy, follow the following steps:

  1. First, make sure you have a Data Pool with a tenant ID configured.
  2. Then, make sure you have an Application.
  3. With a Metric created on top of the tenant-aware Data Pool, select the Metric and choose the "Access Control" tab.
  4. Turn on the "Enable Access control for this Metric" option.
  5. In the Application drop-down menu on the left, select the Application you wish to enable access control for.
  6. In the right-hand policy drop-down menu, select "TENANT_ACCESS". The "ALL_ACCESS" option would grant access to all Metric data, not just data for the specified tenant.

Access tokens created against this Application now require a tenant variable to be passed. If the tenant passed matches the tenant ID specified on the Data Pool, data will be returned. See the Authentication guide for more details on access tokens.