I have a problem with authentication in a multi tenant environment. I have a couple of seperate customers which all have their own SharePoint environment within our hosted environment. In the AD, I created seperate OU's for each client. The subscriptions of each tenant are configured to map to those OU's. This works the way you would expect it to: the people picker only shows accounts from that single OU, other accounts are hidden from view.
But I noticed that this doesn't seem to apply for an "all users" claim. When I grant "All users" access to a site, an account from client A suddenly is able to log into a site of client B and vice versa. I think when logging in, SharePoint only checks if the username / password is correct and then issues a claim to the user. Since a user with a valid claim automatically belongs to "all users", it's granted access to the site. There seems to be no check there to see if the user actually belongs to the correct AD unit.
Now I'm wondering if this is a) expected behaviour b) a bug c) a configuration error on our side
A good solution would be to use a group instead of "all users", but that would require that the users being created from the admin site are also added to that group. And that's not something I want to bother the admins with, let alone myself.