Systems and methods for centralized management of a plurality of cloud services of a cloud-based system

1 . A method comprising steps of:

receiving, at a common Application Programming Interface (API) proxy, a request from a client associated with a cloud-based system, wherein the request is to perform one or more actions associated with the cloud-based system and includes a token presented by the client;

determining if the client is allowed to perform the one or more actions based on a scope associated with the client by transmitting, from the common API proxy to a common authorization module communicatively coupled to the common API proxy, a scope-validation query including an identity of the client, the token, and the requested one or more actions, wherein the common authorization module maintains a mapping of registered clients to corresponding scopes, and receiving from the common authorization module an authorization decision indicating whether the token identifies a scope permitting the one or more actions; and

routing the request to one or more services of the cloud-based system based on the determining when the authorization decision indicates the client is allowed, including automatically determining, by the common API proxy, the one or more services of the cloud-based system associated with the request, and otherwise blocking the request at the common API proxy when the authorization decision indicates the client is not allowed.

2 . The method of claim 1 , wherein the scope indicates one or more actions which the client is allowed to perform on one or more services of the cloud-based system, the scope being identified by the token and enforced based on the authorization decision from the common authorization module.

3 . The method of claim 1 , wherein the steps further comprise:

automatically determining, by the common API proxy, the one or more services of the cloud-based system associated with the request; and

routing the request to the one or more services of the cloud-based system based thereon when the authorization decision indicates the client is allowed to perform the one or more actions.

4 . The method of claim 1 , wherein the steps further comprise:

registering the client with the common authorization module to define the scope; and

providing the client with a token, wherein the token is mapped to, and identifies the scope of the client maintained by the common authorization module.

5 . The method of claim 4 , wherein the steps further comprise:

receiving the token with the request from the client at the common API proxy; and

determining, based on an identity of the client and the token, if the client is allowed to perform the one or more actions by obtaining the authorization decision from the common authorization module.

6 . The method of claim 5 , wherein registering the client and providing the token is performed at a common authorization module, and the routing is performed at the common API proxy, and wherein the common authorization module and the common API proxy are communicatively coupled.

7 . The method of claim 6 , wherein the common API proxy is adapted to, based on receiving a request with a token, consult the common authorization module via the scope-validation query for the determining.

8 . The method of claim 1 , wherein the request is blocked based on the scope associated with the client when the authorization decision indicates the client is not allowed to perform the one or more actions.

9 . A non-transitory computer-readable medium comprising instructions that, when executed, cause one or more processors to perform steps of:

receiving, at a common Application Programming Interface (API) proxy, a request from a client associated with a cloud-based system, wherein the request is to perform one or more actions associated with the cloud-based system and includes a token presented by the client;

determining if the client is allowed to perform the one or more actions based on a scope associated with the client by transmitting, from the common API proxy to a common authorization module communicatively coupled to the common API proxy, a scope-validation query including an identity of the client, the token, and the requested one or more actions, wherein the common authorization module maintains a mapping of registered clients to corresponding scopes, and receiving from the common authorization module an authorization decision indicating whether the token identifies a scope permitting the one or more actions; and

routing the request to one or more services of the cloud-based system based on the determining when the authorization decision indicates the client is allowed, including automatically determining, by the common API proxy, the one or more services of the cloud-based system associated with the request, and otherwise blocking the request at the common API proxy when the authorization decision indicates the client is not allowed.

10 . The non-transitory computer-readable medium of claim 9 , wherein the scope indicates one or more actions which the client is allowed to perform on one or more services of the cloud-based system, the scope being identified by the token and enforced based on the authorization decision from the common authorization module.

11 . The non-transitory computer-readable medium of claim 9 , wherein the steps further comprise:

automatically determining, by the common API proxy, the one or more services of the cloud-based system associated with the request; and

routing the request to the one or more services of the cloud-based system based thereon when the authorization decision indicates the client is allowed to perform the one or more actions.

12 . The non-transitory computer-readable medium of claim 9 , wherein the steps further comprise:

registering the client with the common authorization module to define the scope; and

providing the client with a token, wherein the token is mapped to, and identifies the scope of the client maintained by the common authorization module.

13 . The non-transitory computer-readable medium of claim 12 , wherein the steps further comprise:

receiving the token with the request from the client at the common API proxy; and

determining, based on an identity of the client and the token, if the client is allowed to perform the one or more actions by obtaining the authorization decision from the common authorization module.

14 . The non-transitory computer-readable medium of claim 13 , wherein registering the client and providing the token is performed at a common authorization module, and the routing is performed at the common API proxy, and wherein the common authorization module and the common API proxy are communicatively coupled.

15 . The non-transitory computer-readable medium of claim 14 , wherein the common API proxy is adapted to, based on receiving a request with a token, consult the common authorization module via the scope-validation query for the determining.

16 . The non-transitory computer-readable medium of claim 9 , wherein the request is blocked based on the scope associated with the client when the authorization decision indicates the client is not allowed to perform the one or more actions.

17 . A cloud-based system comprising:

one or more processors and memory storing instructions that, when executed, cause the one or more processors to:

receive, at a common Application Programming Interface (API) proxy, a request from a client associated with the cloud-based system, wherein the request is to perform one or more actions associated with the cloud-based system and includes a token presented by the client;

determine if the client is allowed to perform the one or more actions based on a scope associated with the client by transmitting, from the common API proxy to a common authorization module communicatively coupled to the common API proxy, a scope-validation query including an identity of the client, the token, and the requested one or more actions, wherein the common authorization module maintains a mapping of registered clients to corresponding scopes, and receiving from the common authorization module an authorization decision indicating whether the token identifies a scope permitting the one or more actions; and

route the request to one or more services of the cloud-based system based on the determining when the authorization decision indicates the client is allowed, including automatically determining, by the common API proxy, the one or more services of the cloud-based system associated with the request, and otherwise blocking the request at the common API proxy when the authorization decision indicates the client is not allowed.

18 . The cloud-based system of claim 17 , wherein the scope indicates one or more actions which the client is allowed to perform on one or more services of the cloud-based system, the scope being identified by the token and enforced based on the authorization decision from the common authorization module.

19 . The cloud-based system of claim 17 , wherein the instructions, when executed, further cause the one or more processors to:

automatically determine, by the common API proxy, the one or more services of the cloud-based system associated with the request; and

route the request to the one or more services of the cloud-based system based thereon when the authorization decision indicates the client is allowed to perform the one or more actions.

20 . The cloud-based system of claim 17 , wherein the instructions, when executed, further cause the one or more processors to:

provide the client with a token, wherein the token is mapped to, and identifies the scope of the client maintained by the common authorization module;

receive a request from a client at the common API proxy, wherein the request includes the token; and

determine, based on the token, if the client is allowed to perform one or more actions associated with the request by obtaining the authorization decision from the common authorization module.