serpent
AshAuthentication with multi-tenancy and API keys strategy
Just getting into multi-tenancy and the Ash support for it. My schema looks like:
Organisation (global, tenant entity)
Identity (global) —(has many)—> User (tenant)
User (tenant) —(has many)—> Project (tenant)
Token (global)
So if a User has a record, it means the Identity belongs to the same Organisation as the User record. Authentication is performed for Identity.
Is this reasonable so far?
Now I want to add the API key strategy. But the assumptions are based on a uni-tenant configuration, it seems, adding another strategy to what my schema calls Identity now. But I need the API keys to be associated to an organisation as well, so they need to work for User.
Can I just enable extensions: [AshAuthentication] for User? Of course I tried, but Ash complains:
** (Spark.Error.DslError) authentication -> tokens -> enabled?:
The `:api_key` authentication strategy requires tokens be enabled.
But “tokens” means JWT tokens, no?
What is the recommended approach here? Or is there a flaw in my foundation?
Thanks again to the Ash team for the amazing work! 
First Post!
zachdaniel
Most Liked
zachdaniel
Yeah, I’m just misremembering the implementation. We should not be requiring that. Fixed here: fix: don't require token resource for API keys · team-alembic/ash_authentication@b95b22e · GitHub
serpent
Yay, was able to create a token!
Thank you, Zach!
Found a GraphQL error message that might deserve proper handling. Just FYI, optional cosmetics for now… 
{
"data": {
"createProject": {
"errors": [
{
"message": "something went wrong. Unique error id: `892f6ed9-fce4-42e4-8f0c-827ffcf46b19`"
}
],
"result": null
}
}
}
[warning] `892f6ed9-fce4-42e4-8f0c-827ffcf46b19`: AshGraphql.Error not implemented for error:
** (Ash.Error.Invalid.TenantRequired) Queries against the Zeitmeister.TimeTracking.Project resource require a tenant to be specified
(ash 3.5.24) lib/ash/error/invalid/tenant_required.ex:4: Ash.Error.Invalid.TenantRequired.exception/1
(ash 3.5.24) lib/ash/actions/create/create.ex:602: Ash.Actions.Create.set_tenant/1
Just need to fix my scoping plug now, I guess…
zachdaniel
Right 
yeah, we may need to add more consideration there, like encode the tenant into the api key in some way. Looks like a scenario I didn’t think through fully 
Last Post!
Popular in Questions
Other popular topics
Latest Ash Threads
Latest on Elixir Forum
Sponsor Spotlight
Supporting innovation across the BEAM ecosystem.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #channels
- #elixirconf
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixir-ls
- #phoenix_html
- #iex
- #blog-post
- #graphql
- #genstage
- #ai
- #websockets
- #supervisor
- #elixirconf-us
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #metaprogramming
- #security
- #hex
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Develop your skills with books, videos, and courses.
Producing high quality Elixir screencasts since 2017.
Enabling companies to succeed by building software people love.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"