title: Are there security-risks in managing multi-tenancy based on Claims using IdentityServer4?
body: <p>For some time i've been busy building an identity-server, some complicated structures came up as i'm trying to implemented multi-tenancy.</p>
  
  <p>I would like to know if there are any security-risks regarding the approach im planning to take. Maybe others are struggling as well and could use an example-structure. The following case is present:</p>
  
  <ul>
  <li>One identityserver </li>
  <li>Multiple tenants with seperate domains</li>
  <li>Multiple user-accounts possible for a user per tenant (Student &amp; Teacher)</li>
  <li>Registered with multiple tenants under differentusernames/email-addresses</li>
  <li>SSO required for all tenants at once</li>
  </ul>
  
  <p><strong>The structure i had in mind:</strong>
  A user is logged in at the Identityserver. The available clients (applications/tenants) for which de id-server can provide authentication are presented like a hub. One is selected (Company3 for example) and the option to link an account for this specific tenant is available.</p>
  
  <p>The user provides an email (Student@company3.com) and a verification is sent to the user. The identityserver-database holds data regarding a one-to-many relationship between a user and the registered client, and a one-to-many between these registrations and the verified email-addresses.</p>
  
  <p>When logging into the identityserver, the token would hold the data for the tenants and the verified accounts. This token is returned and the current client verifies the token using the key from the discovery-endpoint.</p>
  
  <p><strong>An example of the custom claims would be:</strong></p>
  
  <pre><code>{
  "company3":[ "student@company3.com", "teacher@company3.com"]
  "company1":[ "student@company1.com", "teacher@company1.com"]
  }
  </code></pre>
  
  <p>Company3 would have secure confirmation that the current user has access to 2 accounts. Company1 would have the same information out the token which makes SSO between the different tenants possible.</p>
  
  <p>As i see it, there wouldnt be any security risks. But, im not very experienced with Identity-servers and authentication yet. I would love some feedback regarding possible security risks.</p>
  
  <p>Cheers</p>