title: Multi-tenant Centralized Authentication Server
body: <p>I am trying to create a centralized authentication server for multiple Django apps (APIs). I've seen posts/recommendations but none fit exactly what I am looking for.</p>
  
  <p><strong>Overview:</strong></p>
  
  <ul>
  <li>Users can be associated to one or multiple projects</li>
  <li>Users have same credentials to all projects they are associated to</li>
  <li>Use <a href="https://en.wikipedia.org/wiki/JSON_Web_Token" rel="nofollow noreferrer">JSON Web Tokens</a> - use payload to add user data, sub-domain (project) to route to, role, etc</li>
  <li>Sub-domain will not be used for login. All users will login to same site and will be routed to project they are associated to (or given list if there are multiple). SSO is optional.</li>
  </ul>
  
  <p><strong>Questions/uncertainties:</strong></p>
  
  <p>Q: Should the authentication tokens be created on the authentication server or on each project? ie) Each user having one auth token for all projects or have one auth token for each project?</p>
  
  <p>Q: Roles will be stored in each app. I would like to send the roles along with the authentication token in the JWT. Should this data be redundantly stored on the authentication server? Another other way would be for the authentication server to access the project databases. What is the best way to handle this? Users will have different roles for each project.</p>
  
  <p>Q: Auth server will have basic user information (email/username, password, first/last name, etc). Since foreign keys can't be used between databases I can use a user proxy based on usernames to create the user on each project. Do the app servers need to have access to which authentication tokens are valid?</p>
  
  <p><strong>Taking advantage of pre-existing software:</strong></p>
  
  <ul>
  <li>Another approach I had in mind was to use django-tenant-schemas which takes advantage of Postgres schemas where each one of my projects would be a schema (currently using MYSQL databases). Does it make sense to take advantage of this?</li>
  <li>Can I take advantage of an IdP service to offload some of the authentication? Does this easily tie into the Django auth layer?</li>
  </ul>