Some thoughts about extranet design and customer data isolation (Share vs DM multi-tenancy)

February 9, 2010

One problem you might experience when designing an Extranet based on Alfresco plateforme, is how to isolate the data of each customers or business unit using the Extranet (not only documents, but also users accounts and groups, and administration priviledge) ?

Basically, I think Alfresco proposes 2 distinct solutions:
– Multi-Tenancy,
– Share site.


Multi-Tenancy wiki page

The purpose of MT is to manage a single physical Alfresco instance, but to be able to split it in distinct logical tenants (like partition).

With MT, you have 1 shared database, but you can configure several “alf_data” directories (e.g one for each customer).
(this might be based on “Content Storage Policies” but I’m not sure).

This MT design was initially provided by Alfresco for SaaS provider (which tries to mutualize their infra. cost), to
clearly separate each customers context.

As far as I know, MT is not designed for large scale deployment (i.e you should not host more than 20 small customers site on the same instance)…
Also, if you are a SaaS provider, you should probably consider using distinct “VMWare” servers…with low cost virtualized servers, you can achieve the same goal, and also have strictly separated backup, etc.

Share site:

Alfresco Share

As long as you have to deal with Extranet, Share is likely to be a better choice.

Initially, I think it has been designed as a front-end application to address an Extranet need.

Also, regarding the data isolation, you have the following options:
– You can create “private” sites (actually site can be public, private or moderated). So your documents will not be visible by others users,
– You can use your internal LDAP (for internal employees) + invite external users. These external account will be stored locally in the Alfresco DB.
– If you invite external account, you can configure the format of the login.
– If you use your internal LDAP, you can continue to manage your existing Group, and do the mapping with the Share site Groups (nested Groups are supported).
– Also, you can easily create new sites (probably not easy to add a new partition to your MT instance).

So as a customer (which has to deploy an Extranet plateform for both internal Employees and external users) I think Share is clearly the best approach.