Take the 2-minute tour ×

My company holds a dozen websites and isolated DBs (identical schemas). every customer has its own website (different app pool) and DB.

every website has its own configuration, several connection strings, but they all have same schema for configuration.




We would like to merge all websites to one (single app pool) and stay with isolated DBs for security and large amount of data reasons.

what is the best practice for designing a DAL and configuration of it? what are the implications of it, if large amount of tenant will be on the same time? does one application pool can manage this situation or it can be managed somehow?

BTW, we are using asp-membership for users authentication.

Thanks in advance, Eddie

share|improve this question
You try to avoid the case that a user A, place on the web.config the User B database - correct ? –  Aristos Jan 9 '13 at 8:13
yes, one of the goals. every customer has its own serveral connectionstrings and other settings. –  Eddie R Jan 9 '13 at 8:20
How about each customer have their personal user account and on the database that need to use for connect - via web.config –  Aristos Jan 9 '13 at 8:25
add comment

2 Answers

Use Application_PostAuthenticate event in global.asax to load the correct database and then close the connection in Application_EndRequest

share|improve this answer
I'm missing a part where i can identify whitch DB with aspmembership to be loaded - what configuration to load. assume that i want to merge all bindings to single website and once customer (group of users in specific company) is connected, the iis (or how responsible for it) will redirect to customer's configuration (like connectionStrings). –  Eddie R Jan 13 '13 at 10:27
add comment

One option is to use the profile in membership and store a piece of information that will allow you to determine which of the actual db's they should be connecting to. Downside is that you will need to store this piece of information for the duration of the users session so either a cookie or session variable is likley to be needed.

The implications of one site vs many depends a lot on your environment and application, do you currently have the multiple sites on a single box or do you have a web farm? do you know the number of concurrent users for each site, the amount of traffic? Performance monitor can help you here to see how busy each site is but you may need more invasive logging to determine metrics such as concurrent users. I found this server fault question around IIS 7 performance which may be of help

share|improve this answer
currently, We have multiple sites on one box (in the future we're going to move it all to amazon and maybe create several web servers). every company has 10 to 20 users. most of the system based on reports so most if the time the machine busy with sql server executions. –  Eddie R Jan 9 '13 at 11:57
with those levels of use you shouldn't have any issues with IIS, you could look at utilising a web garden for this. check out [link] (codeproject.com/Articles/114910/…) for the details on configuring IIS. Unless your applications are trying to open hundreds of connections I don't believe that you'll have any issues but obviously I don't know your code base or environment so can't guarantee anything –  Nathan Jan 9 '13 at 13:10
thanks @Nathan. Most of our web app is executing sql manipulation on large amount of data (based on reports). can i assign each customer (group of users in specific company) to other working process? how to i isolate between customers to maintain high security level? –  Eddie R Jan 13 '13 at 10:29
@EddieR I wouldn't worry about process separation, as long as your data access is thread safe each request will be handled by IIS. You achieve separation by ensuring the correct user accessess the correct db so ensure that each user is only able to access their db using correct credentials, if using Windows Auth then you can rely on active directory, if its forms auth then you need to ensure that users are "given" the correct db connection when created which means not creating the db connection manually instead link it to the co. or group they belong to –  Nathan Jan 13 '13 at 17:28
add comment

Your Answer


