Selective authorization control in multi-tenant applications

1 . A method, comprising:

obtaining, by a device, a request from a widget client of an application to utilize a backend widget, wherein the widget client is integrated with the application;

determining, by the device and based on an identifier of the application and a token associated with the request, whether a user associated with the request is authorized to utilize the backend widget;

determining, by the device and based on the identifier of the application and an identifier of the widget client, whether the application is authorized to utilize the backend widget; and

modifying, by the device and responsive to a determination that the user and the application are authorized to utilize the backend widget, the request to include context for the application to utilize the backend widget.

2 . The method as in claim 1 , wherein the token is issued to the application from an authorization provider based on a determination that a session of the user for the identifier of the application is authorized.

3 . The method as in claim 2 , wherein determining whether the user is authorized to utilize the backend widget includes utilizing the authorization provider to determine whether a pairing of the token and the identifier of the application is valid.

4 . The method as in claim 1 , wherein determining whether the application is authorized to utilize the backend widget includes checking that the identifier of the widget client exists in a backend client identifier repository.

5 . The method as in claim 4 , wherein determining whether the application is authorized to utilize the backend widget includes checking that the identifier of the application matches an application identifier associated with the identifier of the widget client stored in the backend client identifier repository.

6 . The method as in claim 1 , further comprising:

generating the identifier of the widget client for the application in response to an authorization of a request to embed the widget client in the application; and

providing the identifier of the widget client to the application.

7 . The method as in claim 6 , further comprising:

causing the identifier of the widget client and the identifier of the application to be stored in association in a backend client identifier repository.

8 . The method as in claim 6 , further comprising:

performing management operations on the backend widget based on administrative requests specifying the identifier of the widget client.

9 . The method as in claim 1 , wherein the context includes one or more of an identifier of a tenant included with the request or properties included with the request.

10 . The method as in claim 1 , further comprising:

invoking the backend widget to provide a response to the request; and

providing the response to the application.

11 . An apparatus, comprising:

one or more network interfaces;

a processor coupled to the one or more network interfaces and configured to execute one or more processes; and

a memory configured to store a process that is executable by the processor, the process when executed configured to:

obtain a request from a widget client of an application to utilize a backend widget, wherein the widget client is integrated with the application;

determine, based on an identifier of the application and a token associated with the request, whether a user associated with the request is authorized to utilize the backend widget;

determine, based on the identifier of the application and an identifier of the widget client associated with the request, whether the application is authorized to utilize the backend widget; and

modify, responsive to a determination that the user and the application are authorized to utilize the backend widget, the request to include context for the application to utilize the backend widget.

12 . The apparatus as in claim 11 , wherein the token is issued to the application from an authorization provider based on a determination that a session of the user for the identifier of the application is authorized.

13 . The apparatus as in claim 12 , the process when executed further configured to:

determine, by the authorization provider, whether a pairing of the token and the identifier of the application is valid to determine whether the user is authorized to utilize the backend widget.

14 . The apparatus as in claim 11 , the process when executed further configured to:

determine whether the identifier of the widget client exists in a backend client identifier repository to determine whether the application is authorized to utilize the backend widget.

15 . The apparatus as in claim 14 , the process when executed further configured to:

determine whether the identifier of the application matches an application identifier associated with the identifier of the widget client stored in the backend client identifier repository to determine whether the application is authorized to utilize the backend widget.

16 . The apparatus as in claim 11 , the process when executed further configured to:

generate the identifier of the widget client for the application in response to an authorization of a request to embed the widget client in the application; and

provide the identifier of the widget client to the application.

17 . The apparatus as in claim 16 , the process when executed further configured to:

cause the identifier of the widget client and the identifier of the application to be stored in association in a backend client identifier repository.

18 . The apparatus as in claim 16 , the process when executed further configured to:

perform management operations on the backend widget based on administrative requests specifying the identifier of the widget client.

19 . The apparatus as in claim 11 , wherein the context includes one or more of: an identifier of a tenant included with the request or properties included with the request.

20 . A tangible, non-transitory, computer-readable medium storing program instructions that cause a device to execute a process comprising:

obtaining a request from a widget client of an application to utilize a backend widget, wherein the widget client is integrated with the application;

determining, based on an identifier of the application and a token associated with the request, whether a user associated with the request is authorized to utilize the backend widget;

determining, based on the identifier of the application and an identifier of the widget client associated with the request, whether the application is authorized to utilize the backend widget; and

modifying, responsive to a determination that the user and the application are authorized to utilize the backend widget, the request to include context for the application to utilize the backend widget.