Multi-tenant: allow users to exists per tenant (non-global users)

[matteovava]

Hi everyone,

i'm working with Payload v3 in order to build a multi-tenant application, and one of my requirements is to have user defined per-tenant, rather than app-wide.

In other words i'd like to:

• Allow the same email/username to exists in multiple tenants, with the possibility to set different password in each tenant.
• Support some "global admin" users that are not associated with any tenant.

I've already tried removing the unique constraint from the email field in the Users collections and adding a unique index on the (email, tenant) tuple, but that alone doesn't work.
After digging through the docs and the code i found that simply changing the collection definition is not enough since the local-strategy enforce uniqueness at code level.

Has anyone implemented something similar?
Someone has any ideas about creating a "multi-tenant local-strategy" for authentication?

Thanks in advance!

[timothylp]

Hi!

I actually faced the same problem when building a multi-tenant setup with Payload v3.
For now, my workaround is quite simple: I concatenate the tenant ID to the user’s email before saving it.

For example, for tenant #7 and email [email protected], I store it as [email protected].
Then, in an afterRead hook, I strip the tenant ID back out so the user only ever sees their real email.

This way, the default auth strategy continues to work without modification, and I just need to provide the tenant ID when signing up or logging in.

It’s definitely a bit of a hack, and I’d also prefer a cleaner solution with a proper multi-tenant auth strategy and unique constraints per tenant, similar to what you’re describing, but this approach works reliably for now.

[matteovava]

Hi!

I actually faced the same problem when building a multi-tenant setup with Payload v3. For now, my workaround is quite simple: I concatenate the tenant ID to the user’s email before saving it.

For example, for tenant #7 and email [email protected], I store it as [email protected]. Then, in an afterRead hook, I strip the tenant ID back out so the user only ever sees their real email.

This way, the default auth strategy continues to work without modification, and I just need to provide the tenant ID when signing up or logging in.

It’s definitely a bit of a hack, and I’d also prefer a cleaner solution with a proper multi-tenant auth strategy and unique constraints per tenant, similar to what you’re describing, but this approach works reliably for now.

Yes, after some tries i've done the same with two hooks that adds and remove the tenant from the email with hooks like that:

hooks: {
    afterRead: [
      async ({ doc }) => {
        doc.email = doc.tenant ? doc.email.replace(`${doc.tenant}+`, '') : doc.email
        return doc
      },
    ],
    beforeChange: [
      async ({ data, req, originalDoc }) => {
        // Verify that there is no existing user with the same email and tenant
        const existingUser = await req.payload.find({
          collection: 'users',
          depth: 0,
          limit: 1,
          pagination: false,
          where: {
            email: {
              equals: data.tenant ? `${data.tenant}+${data.email}` : data.email,
            },
            tenant: {
              equals: data.tenant ?? null,
            },
          },
        })
        if (existingUser.docs.length > 0) {
          if (!originalDoc || existingUser.docs[0].id !== originalDoc.id) {
            throw new ValidationError({
              collection: 'users',
              errors: [
                {
                  message: req.t('error:userEmailAlreadyRegistered'),
                  path: 'email',
                },
              ],
            })
          }
        }
        data.email = data.tenant ? `${data.tenant}+${data.email}` : data.email
        return data
      },
    ],
  },

But the "filtering" tenant switch is not working in the user collection on the admin, hiding all users if i select a tenant from that, do you know a way to solve that?

[matteovava]

Hi!
I actually faced the same problem when building a multi-tenant setup with Payload v3. For now, my workaround is quite simple: I concatenate the tenant ID to the user’s email before saving it.
For example, for tenant #7 and email [email protected], I store it as [email protected]. Then, in an afterRead hook, I strip the tenant ID back out so the user only ever sees their real email.
This way, the default auth strategy continues to work without modification, and I just need to provide the tenant ID when signing up or logging in.
It’s definitely a bit of a hack, and I’d also prefer a cleaner solution with a proper multi-tenant auth strategy and unique constraints per tenant, similar to what you’re describing, but this approach works reliably for now.

Yes, after some tries i've done the same with two hooks that adds and remove the tenant from the email with hooks like that:

hooks: {
    afterRead: [
      async ({ doc }) => {
        doc.email = doc.tenant ? doc.email.replace(`${doc.tenant}+`, '') : doc.email
        return doc
      },
    ],
    beforeChange: [
      async ({ data, req, originalDoc }) => {
        // Verify that there is no existing user with the same email and tenant
        const existingUser = await req.payload.find({
          collection: 'users',
          depth: 0,
          limit: 1,
          pagination: false,
          where: {
            email: {
              equals: data.tenant ? `${data.tenant}+${data.email}` : data.email,
            },
            tenant: {
              equals: data.tenant ?? null,
            },
          },
        })
        if (existingUser.docs.length > 0) {
          if (!originalDoc || existingUser.docs[0].id !== originalDoc.id) {
            throw new ValidationError({
              collection: 'users',
              errors: [
                {
                  message: req.t('error:userEmailAlreadyRegistered'),
                  path: 'email',
                },
              ],
            })
          }
        }
        data.email = data.tenant ? `${data.tenant}+${data.email}` : data.email
        return data
      },
    ],
  },

But the "filtering" tenant switch is not working in the user collection on the admin, hiding all users if i select a tenant from that, do you know a way to solve that?

I found out why the filtering wasn’t working. I had been using a single custom tenant field in the user collection that pointed to only one tenant. However, it looks like the multi-tenant plugin requires a many-to-many (N:N) relationship between users and tenants. I’ve now switched to using the tenantArrayField with maxRows: 1, and it seems to be working correctly now.