[英]Is this a good way a web service interacts with a multi-tenant database?
I am trying to make my web service identify specific client data to return as JSON. 我试图使我的Web服务标识特定的客户端数据以JSON形式返回。 I am not sure this is the right way, and I'd love some advice.
我不确定这是正确的方法,并且我会建议您。
The way it currently works is: 当前的工作方式是:
WHERE company_id = company_id_in_token
. WHERE company_id = company_id_in_token
SQL返回数据。 The red flags I'm running into are: 我遇到的危险信号是:
Please, I kindly ask you to rip me a new one. 拜托,我请你把我的一个撕掉。
If you refer to the OpenID specification, it states that you send the id_token, but signs it for later verification. 如果您参考OpenID规范,则说明您发送了id_token,但对其进行了签名以供以后验证。 Also, if the upn or sub claim is available, you can infer the tenant from this data.
同样,如果可以使用upn或sub索赔,则可以从此数据推断租户。 However, in case if the userin question works on behalf of another tenant, special headers are required to infer the tenant, example contextual tenant can be a header that contains the tenant under context.
但是,如果所涉及的user代表另一个租户工作,则需要特殊的标头来推断该租户,示例性上下文租户可以是包含上下文中该租户的标头。
In case of having tenant id column, it is a good practice to have a tenant id column in the core business objects tables. 如果有“租户ID”列,那么在核心业务对象表中有一个“租户ID”列是一个好习惯。 There will be no tenant id column in a table that is dependent on the core business object, because it by itself doesn't convey any significance.
在表中没有依赖于核心业务对象的租户id列,因为它本身没有传达任何意义。
HTH HTH
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.