OAuth with Passport.js in a multi tenant application

Question

I am working on a website that will allow multiple tenants using subdomains.

Accounts will be able to add their own subdomains, as long as they don't already exist; eg:

http://tenant1domain1.mywebsite.com
http://tenant1domain2.mywebsite.com
http://tenant2domain1.mywebsite.com
http://tenant2domain2.mywebsite.com

I am also adding in the ability to sign in using a number of oauth providers (google, microsoft, azure ad etc) using passport.js.

All these services will all callback to the main domain (mywebsite.com/login/google/callback) and I need to identify the subdomain of the login request to redirect the user.

As a single user can have multiple subdomains, I can't easily store this against their user record.

I'm running into a problem at the moment where I can't find a way to persist the tenant information past the passport authenticate stage.

I tried using session variables but the session is reset at the callback stage and loses any information I've stored there.

I did think about adding the subdomains as allowed callback urls against each service then just setting the callback to the subdomain but this quickly becomes unmanageable.

Is there any way to make passport.js keep existing session variables intact or to use another method to transfer the tenant information?

Is it possible you pass the tenant name as a part of the OAuth2's state so that it's the provider who just passes it back to you? — Wiktor Zychla
@WiktorZychla The state is setup in the Strategy? Can I pass this a function that gets the tenant like state: getCurrentTenant()? — bendataclear

pspi pspi · Accepted Answer · 2019-02-19T08:01:24

Not a complete answer, but there's a design pattern that keeps &redirect=/url-after-login as a URL query parameter when moving to a login page. After successful login, the login handler then redirects back to this url. The url can be chosen based on the user or the originating page.

Could this work in your situation? Obviously this needs some research on how to implement it in passport.js. Sorry, I can't offer working code.

OAuth with Passport.js in a multi tenant application

1 Answers