There are two types of users that have access to multi-tenant databases: regular tenants and super tenants.

Regular tenants are further classified as the default tenant and regular named tenants. When a multi-tenant database is created, a default tenant is automatically created. When a user signs-in with a user name that does not contain a domain, the only tables available for data access are those defined with a default tenant partition, and any shared tables.

Regular named tenants are tenants that are explicitly defined and named by the database administrator. After a named tenant is defined, at least one domain and one user for that domain must be defined in order to provide access to tenant data. Users signed in to a regular tenant have access to the tenant's data as well as data in shared tables in the database.

The other type of tenant is a super tenant. Just like regular named tenants, a properly defined super tenant must have a least one domain and one user assigned to it in order to provide data access. Logging in as a super tenant provides access to all of the data in the database.

All data access is restricted by any runtime authorization settings in addition to tenancy. Each regular tenant is a separate organizational entity that is unrelated to the other tenants. When users sign-in, they specify both a user name and a domain name. The concept of a domain name exists in prior releases of OpenEdge, but the domain name now has greater prominence. If no domain is specified, internally there is a blank domain to which the user is assigned, and the user is connected to the default tenant.

For access to non-multi-tenant data in legacy applications, no modifications are required to specify a domain because those users use the blank domain by default. Users who are logging in to use data for a regular tenant must specify a domain. The format is the user name and domain name separated by an @. For example, joe@AcmeCorp.

A domain is always associated with one tenant. A user has rights to that tenancy after they are authenticated to the domain, because they then have asserted their tenant identity for that tenancy.