Skip to content

Commit

Permalink
docs: clarify multi-tenancy (#1598)
Browse files Browse the repository at this point in the history
  • Loading branch information
aeneasr authored Nov 10, 2023
1 parent c1a52ac commit d264361
Showing 1 changed file with 3 additions and 16 deletions.
19 changes: 3 additions & 16 deletions docs/kratos/guides/multi-tenancy-multitenant.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,19 +3,6 @@ id: multi-tenancy-multitenant
title: Multitenancy
---

Ory Kratos doesn't implement multi-tenancy in its application logic, but it's possible to implement multi-tenancy with Ory Kratos!

The recommended approach is to run one or more (depending on your scale) SQL databases and create one database schema per tenant
in these database instances. So one PostgreSQL database instance could, for example, host 15000 tenants who each have access to
one schema.

Ory Kratos itself should run as one instance per tenant with a configuration tailored for that specific tenant. The minimum
required change is using different secrets and the tenant's DSN (`postgresql://user:pass@.../tenant-123`). Because Ory Kratos is
very lightweight, the deployment overhead becomes negligible.

Deployment complexity increases but is addressable with container orchestration systems such as
[Kubernetes](https://kubernetes.io/). This approach has several advantages:

- Absolute isolation of tenants which implies: better security, better privacy, more control.
- Easy sharding and partitioning because database schemas isolate tenants.
- No complexity in Ory Kratos business logic and security defenses.
[Ory Network](https://console.ory.sh) is the only available option to have a multi-tenant Ory Kratos set up. It is not possible to
self-host Ory Kratos as a multi-tenant service as its data model does not support this due to data, scalability, and operational
complexity.

0 comments on commit d264361

Please sign in to comment.