Child Databases per User (Customer)

[gllanfranchi]

Hello everyone,
I’d like to offer my customers a graph database for knowledge management or just note taking.
So every customer would get a dedicated child database with a graph.
How would I secure each single child database, so that only the owner is allowed to query the database?

I saw this guide here. The problem for my case is that I want to restrict the role on a database and not only on collections.

So I’d somehow need to create a role which can only access the database, if it’s somehow referenced in the users collection. Would that work and be safe or am I missing something? To me this looks a bit like a hack.

My only idea would be the following:
I create a users collection with a metadata fiel like “owns_database”. So a user can own a database. Then on the server side code, I’d login the user (using fauna auth feature) and then check if the user owns the database thats being queried.
My problem here would be, that I do auth on my server side code and not built in with Fauna.

Is there a better solution for this, which is maybe even offered by Fauna?

Thank’s for the help.

[ptpaterson]

Tokens are generated for an instance in a database. ABAC roles do not extend across databases. Even child databases.

From a login perspective, each user would login with credentials in the child database. So, in this don’t really consider them child databases. The fact that they exist as children of the same single database is convenient for organization and billing.

As one alternative, you may be able to manage users and logins through a common parent db. Then you could use ABAC roles on the parent db to create a Key for one of the child databases. Or maybe you could have a server which, having verified identity, could create an additional Token for an instance on the child database. Either way, the user ends up with 2 Keys/Tokens. One for parent db and one for the child db — if the user wants to read and/or make changes to both dbs, expect to use two clients using the respective Keys/Tokens.

[ptpaterson]

You can also set aside the use of child databases and use separate collections or a single collection and separate data with ABAC roles.

Regarding separation into child databases:

@databrecht

The data separation is indeed very clean but there are also limitations to this approach

This question has come up a few other times here.

Multi-tenant authentication strategies

Hi everyone, I am looking for advice to see if my architectural decisions could be improved. I have an application with several customers. I want to give each customer an isolated child-database, due the benefits of true data isolation, better performance and less complex queries that child-databases provides vs having all the customers in the same DB. Here’s a simplified version of my planned architecture: MainDatabase users_collection user-1 user-2 user-3 … child-databases db-custom…

Does the multi-tenancy model support syncing schemas and aggregating across child databases?

I’ll try to answer to the best of my abilities and ask internally for a better response than mine , there is also this topic with a few answers that might interest you: Best practice for SaaS multi-tenancy Yes. However, you won’t be able to perform a query in one transaction over multiple child database which is probably a limitation you want to keep in mind if you set it up like that since it might not be convenient when you need to join customers with customer data. It’s feasib…

Best practice for SaaS multi-tenancy

thanks, @databrecht. I think creating database per client is not the right way for me. Maybe for B2E SaaS this could make sense as enterprise clients have other requirements. Calling this “multi tenancy” in Fauna docs was somewhat misleading (for me at least). I originally thought that each child database inherits the parent db schema, so I can define everything once, and get a guaranteed sandbox for each customer. Having this would be a real killer feature because it would guarantee that the…

[gllanfranchi]

Thank you for the answer and sorry for my late reply.

I think I’m gonna have to go with one database and a collection (or more) per user. In the users collection I would then have have an additional field which stores the names of their collections. So they login with the normal Fauna process and then my code queries which collections they can access.

Thanks again.