Use the Same User Identities for Different Users Across Tenants

Strategy (September 2026) adds support for identical usernames, LDAP Distinguished Names (DN), and Trusted Authentication IDs for users across different tenants. It also adds support for identical group names across different tenants in multi-tenant environments.

Prerequisite

Enable the feature using the following steps:

Enabling duplicate usernames across tenants is permanent and can not be undone.

  1. Open the Workstation window.

  2. Right-click a project and choose Properties.

  3. In the left pane, click All Settings.
  4. Toggle on Allow duplicate usernames across tenants.
  5. Click Yes and OK.

What User Information Can Be Duplicated Across Tenants

The Administrator username is reserved globally and can not be created at the tenant level.

  • User

    • Username (Login)

    • LDAP Distinguished Name (DN)

    • Trusted Authenticated Request User ID

  • Group

    • User Group Name

    • LDAP Distinguished Name (DN)

User Profile and Data Isolation

When users across different tenants share the same username (for example, there is a user named john in Tenant A and there is another user named john in Tenant B), Strategy ensures complete data and workspace isolation:

  • Each user has an independent Profile Folder (My Reports / My Dossiers)

  • Personal dossiers, reports, shortcuts, and custom objects saved by a user in one tenant are completely isolated and inaccessible to users in other tenants.

Login and Group Sync Behavioral Changes

Action Setting off Setting on

Log in from global Library application

Users from all tenants can log in using their username. Only global users can log in using their username alone.

SSO group sync for a tenant user

Both global groups and same-tenant groups are synced to the tenant user.

Only groups that belong to the same tenant are automatically synced. Administrators can still manually assign global groups to the tenant user.

Allow Tenant Users to Log In From the Global Library Application

When the setting is enabled, tenant users by default log in using their respective tenant-specific Library applications, while the global Library application allows only global users to log in.

If you want tenant users to log in directly from the single global Library application, you can enable the Enable tenant domain resolution on global login setting.

Tenant Domain Resolution allows tenant users to perform standard authentication from the global application using the following log in format and the values are as follows:

Copy 
<login_name><separator><domain_name>

  • <login_name>: The user's original login name.

  • <separator>: Configurable separator string. The default value is @. The maximum length is 5 characters.

  • <domain_name>: The unique domain property configured for the tenant.

For example, if a user in tenant employee has the login name john, and the separator is @:

  • When logging in from the global Library application, the login name is john@employee.

  • When logging in from their tenant-specific Library application, the login name is john.

Configuration Steps

  1. Enable the Enable tenant domain resolution on global login setting:

    1. Open the Workstation window.

    2. Right-click a project and choose Properties.

    3. In the left pane, click All Settings.

    4. Toggle on Enable tenant domain resolution on global login.

    5. Under Enable tenant domain resolution on global login, optionally set a preferred separator. Enter a separator value in Tenant domain separator.

      For example, @, ::, or ///. Avoid characters that are commonly part of the usernames or tenant domains.

    6. Click Yes and OK.

  2. In the Navigation pane, click Tenants.

  3. Right-click your desired tenant and choose Edit.

  4. In the General tab, type a domain identifier value in Domain. The domain is case-insensitve, must be unique across all tenants, and must not contain the configured separator.

  5. Click Save.