Is there a way to have tenant specific JWT token
He u just put the tenants I'd in user table for specifying the user per tenants then you needs to puts all the details in jwt after that in angular side you can get the user details and also tenants details from jwt token for accessing specific tenants per user to secure the endpoint.
I am currently developing a SPA application (angular) with a Python/Flask API in the back-end.
The application will support multiple tenants and I struggle a bit with the security concept. I am currently using jwt-extended
An issued JWT token would be valid for all tenants (I can of course get the user form the token and then check if the user should have access or not to that tenant), but I would perfere to have JWT token that are tenant specific (so that the user get blocked by the @jwt_required).
My idea would be to have different JWT_SECRET_KEY per tenant (so like append the tenant to my key) and then check the validity of the token per tenant (tenant would be identified by the url, either as subdomain or as parameter)
By default,  the key is the on the app level (with app.config('JWT_SECRET_KEY') but it looks like you can overwrite the key encode/decode functions in flask_jwt_extended.JWTManager. I am however not sure which functions I have to override for my @jwt_required to work a I would like (so to use a custoim key in the decoding that would be generated as a concatenate of my key + tenant)
If my concept does not make sense / if there is a better and/or simpler way to achieve this, please let me know.