Securely adding new users to account

Question

In a multi-tenant application, I'm thinking of the right way to let a tenant add users to its account. Assume the "root" user (that signed up and created the tenant) already exists. At some point, the "root" user or other authorized users may add more users to the tenant. The main information provided when adding the new user is its email address. The "recommended" flow I've seen until now is to create the user with a random password and send an email including a password change ticket. My main concern with this approach is what would happen if a valid but wrong address has been provided when creating the user. In such scenario, a non authorized person will be able to set a password and access the tenant data which is a big security flaw. The same question exists even without password change ticket if the login page provides a "Forgot password" flow.

What is the recommended approach when adding new users to a tenant? If the approach I mentioned is appropriate, how to reduce the risk of data access by an unauthorized person?

Answer 1

Somehow the root user must identify the new user. Email sounds like a resaonable choise for identification method. No matter the method, there will always be a risk that the root users is sloppy and pick the wrong new user. (As a parallell: In Sweden, there is a popular app for sending money to someone by phone number. If you mistype the phone number, you donate money to a stranger.)

I can think of a few ways to enhance the security, but not sure I would advocate any of them:

• Make the root user transmit a secret (e.g. a four digit code) to the new user "out of bounds". This way, a misspelled email would not lead to account compromise. Unless the root user sends the secret to the same misspelled email. However, this makes it more complicated to enroll new users. Your marketing department will not like that.

• Make the new user enter some extra information when they create the account, such a name or perhaps a picture. Display this information to the root user an make them accept the new user before making it a tenant. Could prevent mistakes, but do you really want to gather this identifying information?

• Just work with the UI. Empasize that the email must be doulbe checked, warn of mistakes, maybe make the root user enter the email twice and make sure it matches.