OpenSearch Data Separation With JWT Authentication for Multi-tenant Applications
summary
Shows a concrete pattern: an ID provider issues a JWT containing a tenantID claim; a backend microservice reads that claim, looks up routing in a metadata store, and forwards requests to the correct OpenSearch cluster or index; OpenSearch Security uses the same JWT for role mapping and enforces document-level security, so misrouted requests are blocked. Demonstrates three deployment models (silo, bridge, pool) and provides an AWS reproducible sample, proving the approach works end to end.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 1:04OpenSearch in multi-tenant apps
- 3:34JWT auth for OpenSearch
- 5:41OpenSearch roles and permissions
- 8:06Data separation with JWT routing
- 10:58Role settings by isolation level
- 13:08Summary and resources
related talks
50mArchitectural Patterns for Spring Security You Wish Your Tech Lead Knew
54mWho's your user? OpenID from the ground-up
38mEnabling Secure, Fine-Grained Resource Sharing for Team Collaboration in OpenSearch
12mOptimizing Multi-Tenant SaaS
23mAuthentication and Authorization in Micro Services
41mSecuring OpenSearch: Hints for avoiding common hassles
20mPass On Access: User to User Data Sharing With OAuth
40mKnock knock, who's there? Authenticating your single page apps using JSON Web Tokens