Tenant Selection in User Dialog

We added a TenantId field to Users table, but it’s not defined in UserRow, and not visible in user dialog.

This field, should only be seen and edited by admin user. Other users, even if we give them access to users page to manage their tenant users, shouldn’t be able to see or change this information.

Let’s first add it to UserRow.cs:

  1. namespace MultiTenancy.Administration.Entities
  2. {
  3.     //...
  4.     public sealed class UserRow : LoggingRow, IIdRow, INameRow
  5.     {
  6.         //...
  7.         [DisplayName("Last Directory Update"), Insertable(false), Updatable(false)]
  8.         public DateTime? LastDirectoryUpdate
  9.         {
  10.             get { return Fields.LastDirectoryUpdate[this]; }
  11.             set { Fields.LastDirectoryUpdate[this] = value; }
  12.         }
  14.         [DisplayName("Tenant"), ForeignKey("Tenants", "TenantId"), LeftJoin("tnt")]
  15.         [LookupEditor(typeof(TenantRow))]
  16.         public Int32? TenantId
  17.         {
  18.             get { return Fields.TenantId[this]; }
  19.             set { Fields.TenantId[this] = value; }
  20.         }
  22.         [DisplayName("Tenant"), Expression("tnt.TenantName")]
  23.         public String TenantName
  24.         {
  25.             get { return Fields.TenantName[this]; }
  26.             set { Fields.TenantName[this] = value; }
  27.         }
  29.         //...
  30.         public class RowFields : LoggingRowFields
  31.         {
  32.             //...
  33.             public readonly DateTimeField LastDirectoryUpdate;
  34.             public readonly Int32Field TenantId;
  35.             public readonly StringField TenantName;
  36.             //...
  37.         }
  38.     }
  39. }

To edit it, we need to add it to UserForm.cs:

  1. namespace MultiTenancy.Administration.Forms
  2. {
  3.     using Serenity;
  4.     using Serenity.ComponentModel;
  5.     using System;
  6.     using System.ComponentModel;
  8.     [FormScript("Administration.User")]
  9.     [BasedOnRow(typeof(Entities.UserRow))]
  10.     public class UserForm
  11.     {
  12.         public String Username { get; set; }
  13.         public String DisplayName { get; set; }
  14.         [EmailEditor]
  15.         public String Email { get; set; }
  16.         [PasswordEditor]
  17.         public String Password { get; set; }
  18.         [PasswordEditor, OneWay]
  19.         public String PasswordConfirm { get; set; }
  20.         [OneWay]
  21.         public string Source { get; set; }
  22.         public Int32? TenantId { get; set; }
  23.     }
  24. }

Need to also increase size of user dialog a bit, in site.administration.less to make space for tenant selection:

  1. .s-Administration-UserDialog {
  2.     > .size { width: 650px; }
  3.     .caption { width: 150px; }
  4.     .s-PropertyGrid .categories { height: 470px; }
  5. }

Now open User Management page and create a user tenant2 that belongs to Second Tenant.

Tenant2 User

After creating this user, edit its permissions and grant him User, Role Management and Permissions permission as this will be our administrative user for Second Tenant.

Logging In With Tenant2

Signout and login with user tenant2.

When you open User Management page, there may be two different cases you may experience.

In first case, tenant2 might be able to open user dialog and change his and any other users tenant. This happens if your browser cached the tenant lookup.

In the second case, you’ll see that tenant2 can’t open User dialog. When you click a user nothing happens.

If you check browser console (whenever such a thing occurs, you should first check browser console for errors), you’ll see an error like this:

Tenant2 Logged In

This is because, our TenantRow has Administration:Tenants read permission which is inherited by lookup script.

We could change read permission for tenant lookup script to something else to resolve this error, but in that case Tenant2 would be able to see and change tenant of himself and any other user including admin.

This is not what we wanted.

Let’s first prevent him seeing users of other tenants.