[EPIC] Central Enterprise Authentication System for Multi-Tenant SaaS

Description

Problem:
dotCMS currently lacks a centralized enterprise authentication/authorization system that can handle multi-tenant authentication and intelligently route users to their appropriate instances. This creates friction in the user experience and limits our ability to operate as a true SaaS platform.

Current Pain Points:

• No unified authentication entry point across multiple customer instances
• Manual instance routing required for users
• Complex federation setup for each customer
• Difficulty in supporting enterprise identity providers (IDPs) at scale

Proposed Solution:
Implement a central authentication hub similar to how Slack, HubSpot, or Vanta handle authentication:

1. User enters their company domain/email
2. System delegates authentication to the customer's configured IDP (via OIDC/SAML)
3. After successful authentication, system handles authorization and routes user to appropriate dotCMS instance(s)
4. Support for both cloud-hosted and self-hosted authentication solutions

Candidate Solutions:

• Authentik (https://goauthentik.io) - Open-source, free version available, supports OIDC/SAML
• Clerk (https://clerk.com) - Modern auth platform, can be self-hosted, supports OIDC
• Integration with existing Auth0 federation capabilities

Desired Outcome

Success Metrics:

1. User Experience:

   • Single sign-on URL for all dotCMS instances (e.g., login.dotcms.com)
   • Users automatically routed to correct instance(s) after authentication
   • Seamless authentication via company's existing IDP (Okta, Azure AD, Google Workspace, etc.)

2. Operational Efficiency:

   • Reduce customer onboarding time for authentication setup
   • Centralized management of customer authentication configurations
   • Simplified troubleshooting of authentication issues

3. Platform Maturity:

   • Support multi-tenant architecture patterns
   • Enable enterprise-grade authentication features (MFA, conditional access, audit logs)
   • Foundation for future SaaS capabilities (billing, instance management, etc.)

4. Adoption:

   • 90% of new enterprise customers using centralized auth within 6 months of GA
   • Reduced support tickets related to authentication/access issues
   • Customer satisfaction scores improve for authentication experience

Target Personas

• ✅ DevOps teams (simplified deployment and authentication configuration)
• ✅ System administrators (dotCMS) (centralized auth management)
• ✅ Developer teams (API authentication, SSO integration)
• Content teams (indirect benefit through improved login experience)

Links

• Slack discussion: Internal thread from Jan 26, 2025
• Authentik: https://goauthentik.io
• Clerk: https://clerk.com
• Reference architectures: Slack, HubSpot, Vanta authentication flows

Technical Considerations

Key Requirements:

• OIDC/SAML 2.0 support
• Domain-based tenant detection
• IDP federation management
• User-to-instance routing logic
• Session management across instances
• Audit logging and compliance
• Self-hosted and cloud deployment options
• Auth0 integration/migration path

Architecture Components:

• Central authentication service
• Tenant/domain registry
• IDP configuration management
• User routing and authorization service
• Session management
• Admin portal for configuration

Next Steps

1. Spike: Evaluate Authentik vs Clerk vs custom Auth0 solution
2. Technical Design: Architecture for central auth + instance routing
3. POC: Prototype with 2-3 test instances
4. Security Review: Ensure compliance with SOC2, GDPR requirements
5. Migration Plan: Strategy for existing customers

Strategic Impact: This is identified as a critical first step toward operating as a true SaaS company, enabling better customer experience, operational efficiency, and future platform capabilities.