Tag: Hibernate

How Hibernate ORM applies tenant isolation when configured with the DISCRIMINATOR multi-tenancy approach. Working production code can be found in this repository: https://github.com/abstratium-dev/abstrauth. Configuration Set the kind of multi-tenancy to use n application.properties: quarkus.hibernate-orm.multitenant=DISCRIMINATOR An entity declares a tenant discriminator column using @TenantId: @Entity @Table(name = "T_oauth_clients") public class OAuthClient { @Id @Column(length = 36) private String id; @TenantId @Column(name = "org_id", length = 36) private String orgId; // other fields... } A TenantResolver provides the tenant ID for each request: @PersistenceUnitExtension @RequestScoped public class JwtOrgResolver implements TenantResolver { @Override public String resolveTenantId() { // E.g. extract orgId from the JWT Bearer token } } What Hibernate Does Automatically INSERT — org_id is auto-populated Java: em.persist(client); Generated SQL: insert into T_oauth_clients (allowed_scopes, auto_subscribe, client_id, client_name, client_type, created_at, org_id, redirect_uris, require_pkce, id) values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?) The org_id value is set automatically from the resolved tenant — you never set it in code. Tenant ID enforcement on persist Hibernate validates the @TenantId field before emitting the INSERT: Field is null — silently overwritten with the resolved tenant ID. Field differs from resolved tenant — PropertyValueException thrown during flush; no SQL is executed, e.g. PropertyValueException: assigned tenant id differs from current tenant id for entity dev.abstratium.abstrauth.entity.OAuthClient.orgId. em.find() — org_id filter added automatically (when hitting database) Java: em.clear(); // Clear persistence context to force DB round-trip OAuthClient found = em.find(OAuthClient.class, id); Generated SQL: select oc1_0.id, oc1_0.allowed_scopes, oc1_0.auto_subscribe, oc1_0.client_id, oc1_0.client_name, oc1_0.client_type, oc1_0.created_at, oc1_0.org_id, oc1_0.redirect_uris, oc1_0.require_pkce from T_oauth_clients oc1_0 where oc1_0.id = ? and oc1_0.org_id = ? Hibernate appends org_id = ? to the WHERE clause…

Read more