Runtime View
Runtime View
Build-In Confidentiality
Runtime Isolation
The application is a singleton to the running application. A tenant has no knowledge of other tenants or of the application itself. A bounded domain has no knowledge of other bounded domains or of its tenant.
A domain is interested in all users of its tenant having rights in the domain.
The UsersProvider interface provides the list of users for a bounded domain without exposing user or tenant information.
A domain has a type registry to access tag types and code types.
The type registry should be private to the bounded domain. You can share the type registry with other bounded domains of a tenant. It is a slight break of bounded domain isolation.
|
A bounded domain should per convention never access his tenant or application directly. Needed connections such as event buses should be injected during the creation and initialization of the bounded domain. This convention ensures a smooth migration of a bounded domain to a seperate standalone service. A tenant or a bounded domain should not actively track or monitor other tenants or bounded domains. A tenant or a bounded domain should not actively track or monitor associated user interfaces. Use the internal bus to communicate domain changes to the user interface. |
Physical Isolation
The physical level is also isolated.
The files and databases of each tenant are stored in a separate directory.
|
The isolation of files is not a security feature supported by the operating system. The whole application runs under the same user account. |
Use a physical database instance for each tenant. Define a technical user for each tenant and database.
If necessary, use a separate database for each bounded domain. In this case, you should probably define a technical user for each bounded domain of each tenant.
Some database engines are cumbersome in the context of multiple databases. In this case, you can use a separate schema for each tenant or bounded domain. You are still able to use a technical user for each tenant or bounded domain.
Login and Logout
The user interface starts automatically with the login screen. Upon sucessful login, the default bounded domain with its default view is displayed.
After a succesful logout, the login screen is displayed again.