A super-tenant user has access to all the data of a multi-tenant database, including all tenant and shared data, according to the data authorization provided by the user's permission settings. Super-tenant access is enabled by configuring the user's security domain with a super-tenant identity. Data authorization settings work the same as any multi-tenant database user, with permissions for individual tables and fields set based on the user and domain name (see OpenEdge Getting Started: Identity Management).
The initial tenancy of any super tenant provides no access to tenant data. This means that when initially logged in, a super tenant user has implicit access only to shared database objects. To support super-tenant access to multi-tenant database objects, ABL provides features to allow a super tenant user to query and update database objects that belong to one or more regular tenants. In addition, ABL allows a super tenant user to identify the tenant and tenant group identity (if any) to which any given multi-tenant table record belongs.
These features, taken together, allow a super tenant user to perform any run-time action on database objects, regardless of tenancy, and limited only by the data authorization permissions that are defined for the given super tenant. For example, if the super-tenant user identity has only can-read permissions on a given multi-tenant table, the super tenant user can read instances of the table owned by all tenants, but cannot update any instances of the table, including the default tenant instance.
The following sections provide an overview of OpenEdge super tenant capabilities in ABL:
