title: ASP.NET Multi tenant application with tenant specific roles
body: <p>We have a multi-tenant ASP.NET application.  So far tenants have been isolated from each other, however now we have Agencies that manage multiple tenants and want to be able to manage all their tenants with a single user account.  I'm trying to figure out the best way to accomplish that, hopefully without much change to the existing technologies that we are using.</p>
  
  <p>Relevant technical details:</p>
  
  <ul>
  <li>AspNetSqlMembershipProvider for both membership and roles</li>
  <li>C# 4.0 (soon to be 4.5)</li>
  <li>Forms Authentication</li>
  <li>Both aspx and MVC (v3) pages</li>
  <li>Assume 100 or more tenants, so any solution needs to support that</li>
  </ul>
  
  <p>I believe the requirements are very similar to the security model for SQL Server.  We have one set of logins which represent all the users that can login to the system.  Users should be able to be given roles to one or more databases (tenants).  Example: User Bob has admin role in company A, but only user role in company B.  We also have a "sysadmin" role for my company's employees which allow us access to any tenant as well as specialized administrative privileges such as create/delete tenants, etc.</p>
  
  <p>I've done a lot of research into various libraries, frameworks, etc, and I haven't found any convincing evidence that some other library or framework will be better than what we currently have.  So I'm currently thinking of just figuring out how to make Sql Membership provider do what I want, unless someone can point me in a better direction.  I'm also not sure I know the best terms to search for in this.</p>
  
  <p>I've got 2 options I'm considering:</p>
  
  <ol>
  <li>Add only a handful of roles to the membership provider and handle all the questions of "does the current user have this role in this tenant" outside of membership provider.  Membership provider would be used to handle basic access to the system.</li>
  <li>Add tenant specific roles to membership provider.  We would have (# of roles) x (# of tenants) total roles in the system.  Each new tenant would add another set of roles to the system, e.g. "Tenant A:Admin", "Tenant A:User", etc.  Would need some additional tables to manage the relations as well as probably some custom code to ensure that access is requesting the correct tenant-specific role from the membership provider.</li>
  </ol>
  
  <p>Are either of these options good? Or should I be looking elsewhere for support for this? </p>