Cross-domain identity trust using trusted token issuers
Techniques for implementing cross-domain identity trust using trusted token issuers are described. An identity provider is registered with an identity service of a cloud provider network in association with an organization or user. Thereafter, tokens generated by the identity provider can be provided to the identity service as part of token exchanges to obtain new tokens useful for accessing resources managed or provided by applications, such as services, within the cloud provider network. The token exchange process can include use of administrator-provided mapping information indicating how to associate user identity information from an identity provider token with user identity information in a directory utilized by the identity service, whereby the new tokens include identity information that is easily utilized by receiving applications for making access control determinations and performing logging for auditability.
1 . A computer-implemented method comprising:
receiving, at an identity service of a cloud provider network, one or more requests to register a trusted token issuer (TTI) with the identity service, the one or more requests providing a resource identifier associated with the TTI and further including mapping information identifying an attribute from TTI-issued tokens and a corresponding attribute from an identity datastore of the identity service, wherein the TTI is external to the cloud provider network, wherein the one or more requests were originated in association with an administrative account of an organization, wherein the identity service is implemented in the cloud provider network and maintains the identity datastore;
receiving, at the identity service from an application that is external to the cloud provider network, a request to exchange a first token generated by the TTI with a second token to be generated by the identity service, wherein the first token is associated with a first user account of a directory of the TTI;
generating, by the identity service, the second token based at least in part on the mapping information, wherein the second token includes or is based on an identifier of a second user account of the identity datastore; and
transmitting the second token to the application, wherein the application utilizes the second token as part of accessing a second application of the cloud provider network.
2 . The computer-implemented method of claim 1 , wherein:
the TTI comprises an authorization server that is external to the cloud provider network;
the first token is an OAuth compliant token; and
the one or more requests to register the TTI include an identifier of a discovery endpoint associated with the TTI, and wherein the generating of the second token comprises obtaining an encryption key associated with the TTI via use of the discovery endpoint.
3 . The computer-implemented method of claim 2 , further comprising:
receiving a request to enable, for a second application, the TTI as a valid token issuer; and
storing an indication that the TTI is enabled as a valid token issuer for the second application.
4 . A computer-implemented method comprising:
receiving, at an identity service of a cloud provider network, one or more requests to register a trusted token issuer (TTI) with the identity service, the one or more requests providing a resource identifier associated with the TTI and further including mapping information identifying an attribute from TTI-issued tokens and a corresponding attribute from an identity datastore of the identity service, wherein the TTI is external to the cloud provider network, and wherein the identity service is implemented in the cloud provider network and maintains the identity datastore;
receiving, at the identity service from an application, a request to exchange a first token generated by the TTI with a second token to be generated by the identity service, wherein the first token is associated with a first user account of a directory of the TTI;
generating the second token based at least in part on the mapping information, wherein the second token includes or is based on an identifier of a second user account of the identity datastore; and
transmitting the second token to the application.
5 . The computer-implemented method of claim 4 , wherein generating the second token comprises:
performing a lookup in the identity datastore, using a first identifier from the first token, to identify the identifier of the second user account.
6 . The computer-implemented method of claim 4 , wherein the TTI comprises an authorization server that is external to the cloud provider network.
7 . The computer-implemented method of claim 6 , wherein the first token is an OAuth compliant token.
8 . The computer-implemented method of claim 6 , wherein the one or more requests to register the TTI include an identifier of a discovery endpoint associated with the TTI, and wherein the generating of the second token comprises obtaining an encryption key associated with the TTI via use of the discovery endpoint.
9 . The computer-implemented method of claim 6 , further comprising:
receiving a request to enable, for a second application, the TTI as a valid token issuer; and
storing an indication that the TTI is enabled as a valid token issuer for the second application.
10 . The computer-implemented method of claim 4 , further comprising:
receiving, at a second application from the application, a request to access a resource, wherein the request includes the second token;
sending, by the second application, a request to the identity service to obtain data, wherein the request includes the second token;
receiving the data from the identity service, wherein the data comprises the second user identifier and one or more scope values; and
generating a fine-grained access control decision based on the data.
11 . The computer-implemented method of claim 10 , wherein the second token carries encrypted data generated based on plaintext data, wherein the plaintext data includes the identifier of the second user account, an identifier of a second application, and the one or more scope values.
12 . The computer-implemented method of claim 4 , further comprising:
receiving, at the identity service, directory data for the identity datastore from the TTI.
13 . The computer-implemented method of claim 4 , wherein the second application comprises a service within the cloud provider network.
14 . The computer-implemented method of claim 13 , wherein the application is external to the cloud provider network.
15 . A system comprising:
a first one or more computing devices comprising at least a processor and a memory configured to implement an identity datastore in a multi-tenant cloud provider network; and
a second one or more computing devices comprising at least a processor and a memory configured to implement an identity service in the multi-tenant cloud provider network, the identity service including instructions that upon execution cause the identity service to:
receive one or more requests to register a trusted token issuer (TTI) with the identity service, the one or more requests providing a resource identifier associated with the TTI and further including mapping information identifying an attribute from TTI-issued tokens and a corresponding attribute from the identity datastore, wherein the TTI is external to the cloud provider network, and wherein the identity service is implemented in the cloud provider network and maintains the identity datastore;
receive, from an application, a request to exchange a first token generated by the TTI with a second token to be generated by the identity service, wherein the first token is associated with a first user account of a directory of the TTI;
generate the second token based at least in part on the mapping information, wherein the second token includes or is based on an identifier of a second user account of the identity datastore; and
transmit the second token to the application.
16 . The system of claim 15 , wherein to generate the second token, the identity service is at least to:
perform a lookup in the identity datastore, using a first identifier from the first token, to identify the identifier of the second user account.
17 . The system of claim 15 , wherein the TTI comprises an authorization server that is external to the provider network.
18 . The system of claim 17 , wherein the one or more requests to register the TTI include an identifier of a discovery endpoint associated with the TTI, and wherein the generation of the second token comprises obtaining an encryption key associated with the TTI via use of the discovery endpoint.
19 . The system of claim 15 , wherein the identity service further includes instructions that when executed cause the identity service to:
receive a request to enable, for a second application, the TTI as a valid token issuer; and
store an indication that the TTI is enabled as a valid token issuer for the second application.
20 . The system of claim 15 , wherein the second application comprises a service within the multi-tenant cloud provider network.