Senior LevelAuthentication & Authorization
How do you design Multi-Tenant JWT Signing Key Isolation for enterprise SaaS platforms?
❓ Interview Prompt: Explain multi-tenant key isolation, dedicated tenant KMS key pairs, tenant-scoped JWKS endpoints, and cryptographic blast radius reduction.
In enterprise multi-tenant SaaS platforms, using a single shared RSA private key to sign JWTs across all customer tenants creates a critical vulnerability: if the single key leaks, every tenant account is compromised. Multi-Tenant Signing Key Isolation segregates keys.
Architecture Controls:
1
Dedicated Per-Tenant Key Pairs: Each enterprise tenant has a dedicated asymmetric key pair stored in HSM/KMS ('kms-key-tenant-acme').
2
Tenant JWKS Endpoints: Expose tenant-specific JWKS endpoints ('/tenants/{tenantId}/.well-known/jwks.json').
3
Blast Radius Containment: A key compromise affects strictly one tenant without compromising other enterprise customer accounts.
Code Implementation Example
typescript
// Multi-Tenant JWT Signing Service
async function signTenantJwt(tenantId: string, payload: object): Promise<string> {
// Fetch tenant-specific KMS key ARN from registry
const tenantKmsKeyArn = await getTenantKmsKeyArn(tenantId);
// Sign payload strictly with the dedicated tenant key
return await hsmSignPayload(payload, tenantKmsKeyArn, {
issuer: "https://auth.company.com/tenants/" + tenantId,
kid: "key_" + tenantId + "_v1"
});
}💡Signing JWTs using dedicated per-tenant KMS asymmetric keys.
🎯 Interview Key Takeaway
Isolate multi-tenant JWT signing keys by generating dedicated per-tenant KMS key pairs to contain cryptographic breach blast radiuses.
#Multi-Tenant#Key Isolation#KMS#SaaS Security#Senior
Back to all Authentication & Authorization Questions→