Multitenancy with Entity Framework

Question

I have my application, which shares the same database with all my customers.

Separating them only by a column of the table Empresa_Id, all my actions, Save, List, Edit, Delete are done by my Pository.

In my Repospository I pass the Company Id, always before executing the action. But in my Edit, as it sends the ID through the URL to return to the View, I cannot handle it, and others may have access to other people’s data.

So what’s flawed is this method here from Repository:

public virtual T getById(int id)
{
  return _dbSet.Find(id);
}

Any idea to get around this problem?

I even thought about changing my PK all to GUID, but I’m afraid my queries will be too slow (since the Entity Framework is famous for being a slow ORM compared to others).

Answer 1

If you cannot uniquely identify any and all records of the entities in your application, something is very wrong.

In the Multilieutenant model, the key does not necessarily need to be composed. The mistake you are having is because the entity was built more or less like this:

public class Entidade
{
    [Key, Column(Order=1)]
    public int EmpresaId { get; set; }
    [Key, Column(Order=2)]
    public int EntidadeId { get; set; }
    ...
}

Sometimes I have warned about this type of approach. The right thing would be:

public class Entidade
{
    [Key]
    public int EntidadeId { get; set; }
    public int EmpresaId { get; set; }
    ...
}

So you can uniquely identify your records and put the access check rules in the layer Controller, or through Filters, as an example in this answer (the example is for log, but it is a basis for an authorization filter).

Now, if really it is necessary to use composite key in the application, you can change the request link to act as follows:

http://localhost/Entidades/Edit/1?EmpresaId=2

The method in Controller, so it would look like this:

public ActionResult Edit(int id, int EmpresaId) {
    ...
}