Signup and Login Actions for a SaaS application

manishs

I am implementing signup and login for a SaaS application where every user is linked to an organization. Let’s say my application has the URL myapp.com, and every organization has a unique subdomain under my website e.g. myclient1.myapp.com

I have to derive organization ID from the unique subdomain myclient1 and assign it to organization_id field of user table in the database for every signup. For login also, I need to derive the organization_id and find the user by organization_id and the email.

How can I implement this correctly using AshAuthentication? I believe I need to use a custom strategy and make the database call there to fetch organization by unique subdomain and set the organization_id in changeset?

And how do I access the hostname in change method of the custom strategy? With Phoenix, I get this with Plug.Conn by using conn.host. But with Ash custom strategy, I inspected all the available variables - changeset, options and context, it doesn’t seem to be there.

5 comments

/ash #ash-authentication

1 1045 5

2024-03-02 15:11:44 UTC

Showing Posts 1 to 5

Show Best Posts
Show All Posts (oldest first)
Show All Posts (newest first)

zachdaniel

Creator of Ash

Generally this would be done by using multitenancy, and you’d set the tenant in a plug. For example,

In your user resource

multitenancy do
  strategy :attribute
  attribute :organization_id
  global? true # allows working with all orgs without setting a tenant
end

Then, in a plug ahead of the authentication logic, use set_tenant/2 from here Ash.PlugHelpers — ash v2.18.1 to set the tenant to the organization.id that you looked up from the plug.

AshAuthentication honors the tenant when interacting with your user resource. When a tenant is set while using the attribute strategy, the attribute is written to on changes and used in filters when accessing the data.

Post #1

manishs

Thanks for the quick reply. I will give it a try.

A follow up question. Before the signup step, I am also verifying the email by sending a verification code to the email the verification code is stored in user_verifications table in the database.

The signup call happens after the user enters the password. At this stage, I need to make a DB call to check if the email is verified. What is the best way to check this? Do I need to implement a custom strategy/addon and make the DB call and throw an error if the email is not verified?

Here is what my signup flow looks like:

Post #2

zachdaniel

Creator of Ash

Are you using the built in confirmation tooling in ash_authentication? Regardless, the best way to handle this typically is to add a plug after authentication that checks if the user has been confirmed, and if not redirect to the “please verify your email or resend” page.

Post #3

manishs

No, I was not using the built in confirmation tooling. I was looking at the docs for that here. It seems that confirmation tooling is used only for updates, but I’m creating a new record in the signup action. Is it possible to use confirmation tooling while creating a record?

Post #4

zachdaniel

Creator of Ash

@jimsynz can correct me if I’m wrong, but this will work for creation as well as updates. You can then add a plug to check if confirmed_at is not set, and if not, redirect to a page telling them to check their email.

Post #5

— All posts loaded —