In a multi-tenant application, I'm thinking of the right way to let a tenant add users to its account. Assume the "root" user (that signed up and created the tenant) already exists. At some point, the "root" user or other authorized users may add more users to the tenant. The main information provided when adding the new user is its email address. The "recommended" flow I've seen until now is to create the user with a random password and send an email including a password change ticket. My main concern with this approach is what would happen if a valid but wrong address has been provided when creating the user. In such scenario, a non authorized person will be able to set a password and access the tenant data which is a big security flaw. The same question exists even without password change ticket if the login page provides a "Forgot password" flow.

What is the recommended approach when adding new users to a tenant? If the approach I mentioned is appropriate, how to reduce the risk of data access by an unauthorized person?

1 Answer 1


Somehow the root user must identify the new user. Email sounds like a resaonable choise for identification method. No matter the method, there will always be a risk that the root users is sloppy and pick the wrong new user. (As a parallell: In Sweden, there is a popular app for sending money to someone by phone number. If you mistype the phone number, you donate money to a stranger.)

I can think of a few ways to enhance the security, but not sure I would advocate any of them:

  • Make the root user transmit a secret (e.g. a four digit code) to the new user "out of bounds". This way, a misspelled email would not lead to account compromise. Unless the root user sends the secret to the same misspelled email. However, this makes it more complicated to enroll new users. Your marketing department will not like that.

  • Make the new user enter some extra information when they create the account, such a name or perhaps a picture. Display this information to the root user an make them accept the new user before making it a tenant. Could prevent mistakes, but do you really want to gather this identifying information?

  • Just work with the UI. Empasize that the email must be doulbe checked, warn of mistakes, maybe make the root user enter the email twice and make sure it matches.

  • Thanks for your answer. The first approach is the one AWS uses. However, this approach is useless if the user is able to reset his password using "Forgot password" link. I guess "Forgot password" should only be available for root user then? This is what AWS does. The second approach is not appropriate since the new user is not involved until he/she receives the welcome email. The third approach reduces the risk, but what if the user that creates the new user received a wrong email address? In such case, he/she has no way to check. It sounds like the first approach is the most secure.
    – manash
    Dec 16, 2021 at 23:04
  • @manash Yes, I would agree that the first one reduces the risk the most, but at a cost.
    – Anders
    Dec 17, 2021 at 12:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.