1

I'm developing a SaaS platform using hybrid multi-tenancy model.

My SaaS platform has 2 main databases: 1 contains metadata and the other (called default) is a shared database that contains the info required to make the platform work, the remaining databases (named as the company) are copies of the second database with minor changes depending on the client needs.

In metadata database, I store company data like domain, database name (default or company name if the client is a premium client).

My questions are:

Can I store in metadata database the tenant database connection data such as username, password and host?

if so what do I have to keep in mind?

if not can you explain the risks of storing database connection data on a database?

What alternative do I have to use dynamic database connections and avoid doing it manually?

You can read more about hybrid multi-tenancy here: https://blog.sharetechlinks.com/hybrid-multi-tenant-saas-application-system-design/

EDIT:

Having a look on my system design it doesn't make sense to store tenant database connection data as databases always are going to be at my servers, otherwise the client can see part of the system structure.

But I got more questions:

It is safe to use a unique connection data (user and password)for all databases and changing just database name on the fly?(Imagine that the password that controls all the databases got compromised)

MySql stores user information in a database called "mysql" in "user" table, why it's unsafe to create my own database with database connection information if mysql do its by default?

I don't understand security that good, so excuse me if my questions are silly or so obvious

Ger
  • 193
  • 9
  • 1
    Any reason why they have to be stored as database connection strings on your DB and not generated on the fly into a configuration file for each tenant environment? You could state you need to store that config somewhere however you could then just store a hash to verify a config. Having access to the DB connection strings of your clients in a DB could go wrong. You never want to store passwords, only their hashes.
    https://stackoverflow.com/questions/4177060/where-should-i-store-a-database-connection-string     – Rivesticles Aug 03 '21 at 03:06
  • 1
    Sorry @Rivesticles, having a look on my system design it doesn't make sense to store tenant database connection data as databases always are going to be at my servers, otherwise the client can see part of the system structure – Ger Aug 03 '21 at 16:02

0 Answers0