Managing a Multi-tenant Environment

This chapter provides information on how to manage the multi-tenant environment supported by DirX Audit.

About Multi-tenancy

DirX Identity can provide identity management for multiple customers, organizations or separate entities (tenants). It is implemented with one DirX Identity installation hosting several domains: one tenant per domain.

Starting with version 7.0, DirX Audit also provides for multi-tenancy: the ability to configure and operate multiple tenants, which are configuration entities that represent sets of audit database connection settings, authentication and authorization settings, lists of audit sources and server task configurations as well as DirX Audit Message Broker users and queues, all of which remain completely separate from each other within the DirX Audit installation while providing access for the group of authorized tenant specific users to the configured tenant-specific resources. A separate instance of DirX Audit Server and its system service is used for every tenant starting with version 7.2.

Only a single DirX Audit installation is necessary and it guarantees that users and administrators authorized for a particular tenant cannot view or access the data (audit events and history entries) contained in a different tenant. Tenants can practically shadow the structure of existing DirX Identity domains; that is, specific users from individual domains will have access to domain-specific audit events and history entries extracted from the specific DirX Identity domain and stored in tenant-specific DirX Audit Database processed by tenant-specific DirX Audit Server tasks.

The following figure illustrates the DirX Audit tenant architecture.

DirX Audit Tenant Architecture
Figure 1. DirX Audit Tenant Architecture

Configuring and Using DirX Audit Multi-tenancy

This section provides information about DirX Audit’s multi-tenancy features and how multi-tenancy impacts DirX Audit components like DirX Audit Manager, DirX Audit Server processes, DirX Audit Message Broker and DirX Audit Tools.

Setting up Multiple Tenants

DirX Audit multi-tenancy has the following design features:

  • A separate, dedicated Tenant Configuration Wizard is used to create, configure, modify and remove individual tenants. The Core Configuration Wizard configures the global settings. There are also two Start Menu shortcuts to launch the respective configuration wizards; however, it is also possible to seamlessly continue with the tenant configuration once the core configuration is finished. Also see the section "Using the Configuration Wizard for the Tenant Configuration" in "Configuring DirX Audit" in the DirX Audit Installation Guide for further configuration details.

  • Individual tenant configuration files are stored in their respective subfolders in the install_path/conf/tenants/ folder, while the global settings are stored in the install_path/conf/configuration.cfg file.

  • The tenant name is configurable, chosen by the user when a new tenant is created, while the tenant identifier is assigned automatically to ensure its uniqueness and cannot be changed by the user.

  • The tenant configuration must be unique: no tenant can share the same DirX Audit Database, DirX Audit Server file collector folder and LDAP collector settings or DirX Audit Message Broker JMS queue with another tenant to prevent the mixing of data originating from different sources, domains or organizations. Only the DirX Audit Manager authentication settings can be shared between multiple tenants, but a Tenant Configuration Wizard warning will be displayed in these cases.

Using DirX Audit Manager in a Multiple Tenant Environment

The multi-tenant environment has the following effect on DirX Audit Manager:

  • The tenant identifier must be specified in the URL and the respective tenant name is also displayed in the Login page if there are multiple configured tenants. For details, see the section "Logging In" in "Using the DirX Audit Manager" in the DirX Audit User Interface Guide.

  • Once the user logs into the DirX Audit Manager, the tenant name is also displayed next to the username following the “@” separator if there are multiple configured tenants.

  • All DirX Audit Manager tabs - Dashboard, Audit analysis, Reports and History - display only data from relevant tenant-specific DirX Audit databases.

  • The authentication and authorization settings are also tenant-specific, which means that only authorized users existing in configured tenant-specific authentication source systems (for example, specific DirX Identity domains) can view or access the data of the given tenant.

DirX Audit Server Processes in a Multiple Tenant Environment

A separate instance of DirX Audit Server is used for every tenant starting with version 7.2. DirX Audit Server operates with its specific DirX Audit Message Broker queues, connected DirX Identity domain, file collector folders, and DirX Audit databases.

DirX Audit Message Broker Operations in a Multiple Tenant Environment

The multi-tenant environment has the following effect on the DirX Audit Message Broker operation:

  • The DirX Audit Message Broker configuration creates special queues for each collector and tenant that include the tenant identifier. There are also tenant-specific users with read and write access rights created for each tenant, each of them including the tenant identifier. For further configuration details, see the section "Common JMS Collector Credentials" and all Server JMS Collector sections in "Using the Configuration Wizard for the Tenant Configuration" in the DirX Audit Installation Guide.

  • When a tenant is removed, its queues will remain active (but without a consumer / server endpoint) until they are deleted manually.

Using DirX Audit Tools in a Multiple Tenant Environment

The multi-tenant environment has the following effect on the DirX Audit Tools:

  • Tool users must specify the tenant whose configuration (database connection setting) should be used to access the database to be processed with the tool. See the chapter "Using the DirX Audit Tools" in the DirX Audit User Interface Guide for the command syntax description.