I’m using self-hosted Ory Kratos and trying to implement multi-tenancy. Goal: Same login UI, but credentials isolated per tenant. Example: user1 in tenant-a → password X user1 in tenant-b → password Y These should be two separate identities, even though the username is the same. I’ve seen suggestions about adding tenant_id to the identity schema. But I’m not sure: Does marking tenant_id + username as identifiers create a composite identity, or does it just allow login with either field?

I think an easier solution would be to host 2 instances of Kratos. How does the login flow work exactly? Like how does the system know user1 wants to login to tenant a instead of tenant b? i dont know much about your use case but I would suggest some UI where the user chooses the tenant and then you just redirect to the respective Ory Kratos instance. We also offer the Ory Enterprise License for Ory Kratos with "true" multitenancy, if you have a lot of tenants.

Actually, I want to achieve this using a single Kratos instance. My flow is as follows: I use a custom UI and a backend that communicates with Kratos. When a user lands on the login page, my backend identifies the client and its associated tenant via the login_challenge. My goal is to send the login request from my backend to Kratos by including the tenant information along with the username and password. I want to isolate users by a tenant_id field within the same instance. What is the best practice for handling multi-tenancy in a single instance? Should I use metadata_public/admin or include a tenant_id in the identity traits and use it during authentication?