Skip to content
Authreads

Multi-tenant architecture

Per-tenant SSO: routing each customer to their own identity provider

How B2B products route users to the right identity provider: home realm discovery, domain verification, tenant-specific login URLs, and fallbacks.

The short answer

Per-tenant SSO means each customer configures their own identity provider, and your login flow works out which one to use before authenticating — usually from a verified email domain, a tenant-specific login URL or subdomain, or an explicit organization picker. Domain-based routing must rely on domains the tenant has proven it owns, or one customer can capture another's users.

Sources last reviewed .

Home realm discovery options

  • Email domain: the user types an email; the domain maps to a tenant's IdP. Requires domain verification (for example a DNS TXT record) so a tenant cannot claim gmail.com or a competitor's domain.
  • Tenant URL: acme.example.com or example.com/login/acme selects the tenant before the user types anything.
  • Organization picker or code: explicit, and leaks less information, at the cost of an extra step.

Edge cases

  • One domain shared by several tenants (subsidiaries, agencies).
  • Contractors whose email domain belongs to a different organization than the tenant they work in.
  • Administrators who must still sign in when the customer's IdP is down — a break-glass path that is audited.
  • Avoid revealing whether an email exists or which IdP a domain uses, where that is sensitive (OWASP Authentication Cheat Sheet on account enumeration).

In Authreads

How this applies to Authreads

Per-tenant federation with external identity providers via SAML is Planned. Custom login domains are In progress. Hosted login per tenant with per-tenant policy is Available.

Authreads is a multi-tenant identity platform in beta. Capability status is maintained on /roadmap as Available, In progress or Planned.

Sources

Keep reading

Protocols and how-tos

SAML SSO for B2B SaaS: what enterprise customers will ask for

Multi-tenant architecture

B2B login flows: invitations, domains, SSO and the first admin

Multi-tenant architecture

Designing identity for a multi-tenant SaaS product

Glossary: Single sign-on (SSO) · SAML · Hosted login · Custom login domain

All 38 guides

Building on any of this?

Tell us what you're putting together. We'll tell you plainly whether Authreads fits it.