System and method of providing granular access control

1 . A data processing system for providing access to a resource hosted by a resource provider, the resource allocated to a tenant customer of the resource provider and the resource managed by a partner organization of the tenant customer or the resource provider, the data processing system comprising:

a processor; and

a memory in communication with the processor, the memory comprising executable instructions that, when executed by the processor, cause the data processing system to perform functions of:

receiving, from a user at the partner organization, an access request and a token, the access request indicating a task to be performed on the resource by the user, and the token including data indicating an access role granted to the user by the tenant customer from amongst a plurality of possible access role types including a granular delegated access role, where the granular delegated access role indicates access to the resource is subject to an added granular permission check;

determining that the access role is a granular delegated access role;

in response to determining that the access role is a granular delegated access role, performing the added granular permission check including mapping the access role with a role-to-permission map to determine one or more permissions available to the user;

authorizing the task based on an object model and the one or more permissions; and

in response to the authorization, permitting the user to perform the task on the resource.

2 . The data processing system of claim 1 , wherein retrieving the access role from the access token, examining the role-to-permissions map, and determining that the user is authorized to perform the task on the resource is done by a role-based access control manager.

3 . The data processing system of claim 2 , wherein the role-based access control manager utilizes a role-bootstrap module.

4 . The data processing system of claim 1 , wherein the access token includes a field for storing the access role.

5 . The data processing system of claim 4 , wherein the field is a well-known identifier (WID) field.

6 . The data processing system of claim 5 , wherein a granular delegated identifier GUID in the WID field indicates that the user has Granular Delegated Admin Permission.

7 . The data processing system of claim 1 , wherein an organization of the tenant customer is divided into a plurality of tenant departments, the access role granted to the user includes an admin unit role corresponding to a tenant department.

8 . The data processing system of claim 7 , wherein the resource allocated to the tenant customer is divided into portions each associated with one or more of the tenant departments, the admin unit role is resource scoped to a particular portion associated with the tenant department corresponding to the admin unit role.

9 . The data processing system of claim 1 , wherein the tenant customer includes a plurality of tenant subunits, the task is associated with a first of the tenant subunits, and the authorizing the task based on the object model includes determining whether the access role permits the task associated with the tenant subunit.

10 . The data processing system of claim 1 , wherein in response to determining that the access role is a granular delegated access role, the permitting the user to perform the task is restricted based on a time restriction included in the token.

11 . A method for providing access to a resource hosted by a resource provider, the resource allocated to a tenant customer of the resource provider and the resource managed by a partner organization of the tenant customer or the resource provider, the method comprising:

receiving, from a user at the partner organization, an access request and a token, the access request indicating a task to be performed on the resource by the user, and the token including data indicating an access role granted to the user by the tenant customer from amongst a plurality of possible access role types including a granular delegated access role, where the granular delegated access role indicates access to the resource is subject to an added granular permission check;

determining that the access role is a granular delegated access role;

in response to determining that the access role is a granular delegated access role, performing the added granular permission check including mapping the access role with a role-to-permission map to determine one or more permissions available to the user;

authorizing the task based on an object model and the one or more permissions; and

in response to the authorization, permitting the user to perform the task on the resource.

12 . The method of claim 11 , wherein retrieving the access role from the access token, examining the role-to-permissions map, and determining that the user is authorized to perform the task on the resource is done by a role-based access control manager.

13 . The method of claim 11 , wherein the access token includes a field for storing the access role.

14 . The method of claim 13 , wherein the field is a well-known identifier (WID) field.

15 . The method of claim 14 , wherein a granular delegated identifier GUID in the WID field indicates that the user has Granular Delegated Admin Permission.

16 . The method of claim 11 , wherein the access role assigned to the user includes an admin unit role.

17 . The method of claim 16 , wherein the admin unit role is resource scoped.

18 . A non-transitory computer readable medium on which are stored instructions for providing access to a resource hosted by a resource provider, the resource allocated to a tenant customer of the resource provider and the resource managed by a partner organization of the tenant customer or the resource provider, wherein the instructions, when executed, cause a programmable device to perform functions of:

receiving, from a user at the partner organization, an access request and a token, the access request indicating a task to be performed on the resource by the user, and the token including data indicating an access role granted to the user by the tenant customer from amongst a plurality of possible access role types including a granular delegated access role, where the granular delegated access role indicates access to the resource is subject to an added granular permission check;

determining that the access role is a granular delegated access role;

in response to determining that the access role is a granular delegated access role, performing the added granular permission check including mapping the access role with a role-to-permission map to determine one or more permissions available to the user;

authorizing the task based on an object model and the one or more permissions; and

in response to the authorization, permitting the user to perform the task on the resource.

19 . The computer readable medium of claim 18 , wherein retrieving the access role from the access token, examining the role-to-permissions map, and determining that the user is authorized to perform the task on the resource is done by a role-based access control manager.

20 . The computer readable medium of claim 18 , wherein the access token includes a well-known identifier (WID) field for storing the access role.