Authentication

Authentication/authorization are inherited from the Base Template. Entitlements adds SaaS tenant scoping.

Tenant context

Resolved via TenantResolutionStrategy (ConfigurationFirstThenJwtThenHeaders): JWT tid, HTTP X-Tenant-Id, messaging tenant-id. The resolved tenant feeds the SaasTenantFilter so the per-tenant entitlement aggregate, assignments, and overrides are scoped automatically (one entitlement per tenant).

Inbound catalog events carry tenant scope (ITenantScopedMessage) so the reaction saga reconciles assignments within the correct tenant partition.

See also

• Configuration
• Base Template