Feature: Per-Tenant Authentication Strategy Resolution #25

New issue

Closed

opened 2026-07-05 20:20:11 +00:00 by psycodepath · 0 comments

psycodepath commented

2026-07-05 20:20:11 +00:00

Owner

Motivation

Currently, the authentication strategy is global. Tenants need to use different authentication methods (e.g., family A uses the local user database, family B uses their LDAP directory, production uses Authelia headers).

Description

Implement a dynamic TenantAwarePasswordAuthenticator that checks the current tenant's database settings at runtime and delegates credentials checking to the appropriate authenticator (LocalPasswordAuthenticator, LdapPasswordAuthenticator).

User Story

As a tenant user, I want to log in using the authentication strategy configured for my specific family/subdomain so that I can use my preferred credentials provider.

Gherkin Feature

Feature: Tenant-Specific Authentication Strategy
  As a tenant user
  I want to log in with my tenant's configured auth strategy
  So that I am authenticated against the correct backend

  Scenario: Tenant uses LDAP strategy
    Given the current tenant is configured to use "ldap" auth strategy
    When I submit my credentials
    Then the request is handled by the LdapPasswordAuthenticator

Acceptance Criteria

TenantAwarePasswordAuthenticator implemented, delegating based on runtime tenant settings.
LdapPasswordAuthenticator refactored to accept configuration settings dynamically instead of reading $_ENV directly.
DI container configuration updated in AppBootstrap.php to wire the new tenant-aware authenticators.
Unit and integration tests covering multi-tenant auth routing.

### Motivation Currently, the authentication strategy is global. Tenants need to use different authentication methods (e.g., family A uses the local user database, family B uses their LDAP directory, production uses Authelia headers). ### Description Implement a dynamic `TenantAwarePasswordAuthenticator` that checks the current tenant's database settings at runtime and delegates credentials checking to the appropriate authenticator (`LocalPasswordAuthenticator`, `LdapPasswordAuthenticator`). ### User Story As a tenant user, I want to log in using the authentication strategy configured for my specific family/subdomain so that I can use my preferred credentials provider. ### Gherkin Feature ```gherkin Feature: Tenant-Specific Authentication Strategy As a tenant user I want to log in with my tenant's configured auth strategy So that I am authenticated against the correct backend Scenario: Tenant uses LDAP strategy Given the current tenant is configured to use "ldap" auth strategy When I submit my credentials Then the request is handled by the LdapPasswordAuthenticator ``` ### Acceptance Criteria - [ ] `TenantAwarePasswordAuthenticator` implemented, delegating based on runtime tenant settings. - [ ] `LdapPasswordAuthenticator` refactored to accept configuration settings dynamically instead of reading `$_ENV` directly. - [ ] DI container configuration updated in `AppBootstrap.php` to wire the new tenant-aware authenticators. - [ ] Unit and integration tests covering multi-tenant auth routing.

psycodepath referenced this issue from a commit

2026-07-05 20:29:08 +00:00

feat: implement per-tenant authentication strategy resolution (#25)

psycodepath referenced this issue from a pull request that will close it,

2026-07-05 20:29:11 +00:00

feat: implement per-tenant authentication strategy resolution (#25) #27

psycodepath closed this issue

2026-07-05 20:31:04 +00:00

psycodepath referenced this issue from a commit

2026-07-05 20:31:05 +00:00

Merge pull request 'feat: implement per-tenant authentication strategy resolution (#25)' (#27) from feature/tenant-aware-auth into main