Intermediate LevelAuthentication & Authorization
How do you design a Multi-Tenant Auth system supporting custom Enterprise IdPs per tenant?
❓ Interview Prompt: Explain multi-tenant SAML/OIDC routing, domain discovery, home realm discovery, and dynamic IdP selection.
In B2B SaaS platforms, enterprise customers require signing in using their own custom Identity Providers (Okta, Azure AD) via SAML or OIDC. Home Realm Discovery (HRD) routes users to their specific tenant IdP.
Routing Architecture:
1
Domain Discovery: User enters email ('alice@acme.com').
2
Tenant Domain Match: Server extracts domain ('acme.com') and looks up tenant configurations in DB.
3
Dynamic IdP Redirection:
•
If 'acme.com' has custom SAML configured, redirect to 'acme.okta.com'.
•
If no custom IdP, fallback to default password/passkey login.
4
Tenant Context Assertion: SAML/OIDC response is validated against the specific tenant's X.509 certificate or JWKS URL.
Code Implementation Example
typescript
async function resolveHomeRealmIdp(email: string): Promise<string> {
const domain = email.split('@')[1];
const tenantConfig = await db.tenants.findByDomain(domain);
if (tenantConfig && tenantConfig.ssoEnabled) {
return "https://auth.company.com/sso/saml/login?tenantId=" + tenantConfig.id;
}
return "/login/default"; // Fallback to standard login
}💡Home Realm Discovery routing user emails to custom tenant IdP URLs.
🎯 Interview Key Takeaway
Multi-tenant auth uses Home Realm Discovery to route users to tenant-specific SAML/OIDC Identity Providers based on email domains.
#Multi-Tenant#HRD#Enterprise SSO#Routing#Intermediate
Back to all Authentication & Authorization Questions→