> How is the authentication of tenants handled?

reverse proxy.

I think this approach is sufficient for now. In the future, RBAC makes sense (again, that data supplied by the reverse proxy).