Skip to content

Trusted Tenant Relationships

Overview

The Trusted Tenant feature enables cross-tenant resource management without requiring separate authentication tokens or admin group membership for each tenant. Tenant administrators can delegate management privileges to other tenants through configurable trust relationships.

Use Cases

Trusted tenant relationships are useful when:

  • Centralized Administration: A central IT team needs to manage multiple organizational tenants from a single admin account
  • Managed Service Providers: External administrators manage client tenants without needing separate credentials
  • Hierarchical Organizations: Parent organizations oversee subsidiary tenants while maintaining separation
  • Shared Services: A shared services tenant manages resources across multiple business unit tenants

How It Works

When a trust relationship is established:

  1. Tenant B trusts Tenant A: Administrators of Tenant A can manage Tenant B's resources
  2. Single Authentication: Admins use their Tenant A credentials—no re-authentication needed
  3. Full Access: Trusted admins have the same capabilities as native tenant admins

Trust Relationship Direction

Trust relationships are unidirectional:

  • If Tenant B trusts Tenant A, then Tenant A admins can manage Tenant B
  • This does NOT mean Tenant B admins can manage Tenant A
  • To enable bidirectional management, create trust relationships in both directions

Managing Trust Relationships

API Endpoints

All endpoints require tenant admin privileges and are under /auth/admin/tenants/{tenantId}:

Method Endpoint Description
PUT /trust-tenant/{trustedTenantId} Establish trust relationship
DELETE /trust-tenant/{trustedTenantId} Remove trust relationship
GET /manages-tenants List tenants managed by this tenant
GET /managed-by-tenants List tenants that manage this tenant

Examples

Establish trust (allow Tenant A admins to manage Tenant B):

PUT /auth/admin/tenants/B/trust-tenant/A
Authorization: Bearer <tenant-admin-token>

Remove trust relationship:

DELETE /auth/admin/tenants/B/trust-tenant/A
Authorization: Bearer <tenant-admin-token>

List all tenants that Tenant A can manage:

GET /auth/admin/tenants/A/manages-tenants
Authorization: Bearer <token>

List all tenants that can manage Tenant B:

GET /auth/admin/tenants/B/managed-by-tenants
Authorization: Bearer <token>

Using the Authifi Admin UI

  1. Log in to the Authifi Admin UI as a tenant administrator
  2. Navigate to the target tenant's settings
  3. Select Trusted Tenants from the menu
  4. Add or remove trusted tenant relationships as needed

Security Considerations

Access Requirements

  • Admin Privileges Required: Only tenant administrators can establish or remove trust relationships
  • Identity Provider Validation: Users must authenticate via trusted identity providers
  • Audit Logging: All cross-tenant access is logged with full context for compliance

Best Practices

  1. Principle of Least Privilege: Only grant trust to tenants that require cross-tenant management
  2. Regular Review: Periodically audit trust relationships and remove those no longer needed
  3. Document Relationships: Maintain records of why each trust relationship exists
  4. Monitor Access: Use audit logs to track cross-tenant administrative actions

Limitations

  1. Client Credentials Exclusion: Service-to-service authentication (client credentials flow) cannot use trusted tenant features—only user-based authentication is supported
  2. Admin-Only Access: The feature is limited to users with tenant administrator privileges
  3. Unidirectional Trust: Each trust relationship is one-way; bidirectional access requires two separate relationships
  4. Partial Endpoint Coverage: Some Authifi endpoints may not recognize trusted tenant relationships

Configuration

The Trusted Tenant feature requires no additional configuration:

  • Enabled by default in all Authifi deployments
  • No environment variables or settings changes needed
  • Works with existing authentication infrastructure