Methods, systems, and computer readable media for implementing user authorization in cloud applications

1 . A method for implementing user authorization in cloud applications, the method comprising:

receiving, at a sub-authorization computing device from a user interface of a cloud application, and in response to a user login event, a user token;

querying, by the sub-authorization computing device and using the user token, an identity provider for authorization status of a first user for the cloud application;

receiving, at the sub-authorization computing device from the identify provider, an indication of authorization status of the first user to access at least one feature of the cloud application;

determining, by the sub-authorization computing device, first feature access data for the first user using the indication of the authorization status of the first user and a feature map of the cloud application, the first feature access data being configured to cause the user interface of the cloud application to display at least one graphical element for enabling the first user to access the at least one feature of the cloud application, wherein the at least one feature comprises a new feature of the cloud application that is being tested by a selected group of users, wherein the feature map of the cloud application lists a plurality of resources of the cloud application and scopes, wherein the scopes define actions allowed to be performed on the resources, and wherein the feature map is editable to assign a role of test engineer to the users in the selected group of users and editable to assign permissions associated with release of the at least one feature to the role of test engineer; and

sending, by the sub-authorization computing device to the user interface of the cloud application, the first feature access data;

at the cloud application, allowing the user to access features of the cloud application identified by the first feature access data;

while the user is logged in to the cloud application:

receiving, by the sub-authorization computing device, an indication of an updated authorization status of the user;

generating, by the sub-authorization computing device, revised feature access data for the user indicating permission changes for the user;

sending, by the sub-authorization computing device and to the cloud application user interface, the revised feature access data for the user; and

updating, by the cloud application user interface, graphical elements that indicate the permission changes.

2 . The method of claim 1 comprising querying an identity provider for authorization status of a first user for the cloud application using features in a feature map.

3 . The method of claim 1 wherein determining the first feature access data for the first user comprises:

identifying, by the sub-authorization computing device and in the feature map, the at least one feature of the cloud application; and

associating, by the sub-authorization computing device, the at least one feature in the feature map with the corresponding at least one feature in the indication of the authorization status of the first user from the identity provider.

4 . The method of claim 1 comprising changing, by the sub-authorization computing device, the authorization status of the first user to access the at least one feature of the cloud application based on administrator instructions.

5 . The method of claim 1 comprising receiving, by the sub-authorization computing device and from the first user, a request to access a feature of the cloud application from an application programming interface (API), matching the requested feature with a corresponding feature in a feature map, and querying the identity provider to determine whether the first user is authorized to access the requested feature using the user token and the matched feature in the feature map.

6 . The method of claim 1 wherein receiving the user token in response to the login event comprises:

intercepting, by the sub-authorization computing device, traffic from the user interface of the cloud application to a backend of the cloud application; and

identifying, by the sub-authorization computing device, a user token among the traffic.

7 . The method of claim 1 comprising determining, by the sub-authorization computing device and based on an indication of authorization status of a second user, second feature access data to access at least one feature of the cloud application, wherein the indication of the authorization status of the second user is distinct from the indication of the authorization status of the first user and the second feature access data is distinct from the first feature access data.

8 . The method of claim 7 wherein the second feature access data is configured to cause the user interface of the cloud application to display at least one graphical element for the second user distinct from the at least one graphical element for the first user.

9 . A system for implementing user authorization in cloud applications, the system comprising:

a processor;

a memory communicatively connected to the processor; and

a sub-authorization computing device implemented using the processor and the memory, wherein the sub-authorization computing device is configured for:

receiving, from a user interface of a cloud application, and in response to a user login event, a user token;

querying, using the user token, an identity provider for authorization status of a first user for the cloud application;

receiving, from the identify provider, an indication of authorization status of the first user to access at least one feature of the cloud application;

determining first feature access data for the first user using the indication of the authorization status of the first user and a feature map of the cloud application, the first feature access data being configured to cause the user interface of the cloud application to display at least one graphical element for enabling the first user to access the at least one feature of the cloud application, wherein the at least one feature comprises a new feature of the cloud application that is being tested by a selected group of users, wherein the feature map of the cloud application lists a plurality of resources of the cloud application and scopes, wherein the scopes define actions allowed to be performed on the resources, and wherein the feature map is editable to assign a role of test engineer to the users in the selected group of users and editable to assign permissions associated with release of the at least one feature to the role of test engineer;

sending the first feature access data to the user interface of the cloud application;

at the cloud application, allowing the user to access features of the cloud application identified by the first feature access data; and

while the user is logged in to the cloud application:

receiving, by the sub-authorization computing device, an indication of an updated authorization status of the user;

generating, by the sub-authorization computing device, revised feature access data for the user indicating permission changes for the user;

sending, by the sub-authorization computing device and to the cloud application user interface, the revised feature access data for the user; and

updating, by the cloud application user interface, graphical elements that indicate the permission changes.

10 . The system of claim 9 wherein determining the first feature access data for the first user comprises:

identifying, in the feature map, the at least one feature of the cloud application; and

associating the at least one feature in the feature map with the corresponding at least one feature in the indication of the authorization status of the first user from the identity provider.

11 . The system of claim 9 wherein the sub-authorization computing device is configured for changing the authorization status of the first user to access the at least one feature of the cloud application based on administrator instructions.

12 . The system of claim 9 wherein the sub-authorization computing device is configured for receiving, from the first user, a request to access a feature of the cloud application from an application programming interface (API), matching the requested feature with a corresponding feature in a feature map, and querying the identity provider to determine whether the first user is authorized to access the requested feature using the user token and the matched feature in the feature map.

13 . The system of claim 9 wherein receiving the user token in response to the login event comprises:

intercepting traffic from the user interface of the cloud application to a backend of the cloud application; and

identifying a user token among the traffic.

14 . The system of claim 9 wherein the sub-authorization computing device is configured for querying an identity provider for authorization status of a first user for the cloud application using features in a feature map.

15 . The system of claim 9 wherein the sub-authorization computing device is configured for determining, based on an indication of authorization status of a second user, second feature access data to access at least one feature of the cloud application, wherein the indication of the authorization status of the second user is distinct from the indication of the authorization status of the first user and the second feature access data is distinct from the first feature access data.

16 . The system of claim 15 wherein the second feature access data is configured to cause the user interface of the cloud application to display at least one graphical element for the second user distinct from the at least one graphical element for the first user.

17 . A non-transitory computer readable medium having stored thereon executable instructions that when executed by at least one processor of at least one computer cause the at least one computer to perform steps comprising:

receiving, from a user interface of a cloud application, and in response to a user login event, a user token;

querying, using the user token, an identity provider for authorization status of a first user for the cloud application;

receiving, from the identify provider, an indication of authorization status of the first user to access at least one feature of the cloud application;

determining first feature access data for the first user using the indication of the authorization status of the first user and a feature map of the cloud application, the first feature access data being configured to cause the user interface of the cloud application to display at least one graphical element for enabling the first user to access the at least one feature of the cloud application, wherein the at least one feature comprises a new feature of the cloud application that is being tested by a selected group of users, wherein the feature map of the cloud application lists a plurality of resources of the cloud application and scopes, wherein the scopes define actions allowed to be performed on the resources, and wherein the feature map is editable to assign a role of test engineer to the users in the selected group of users and editable to assign permissions associated with release of the at least one feature to the role of test engineer;

sending the first feature access data to the user interface of the cloud application;

at the cloud application, allowing the user to access features of the cloud application identified by the first feature access data; and

while the user is logged in to the cloud application:

receiving, by the sub-authorization computing device, an indication of an updated authorization status of the user;

generating, by the sub-authorization computing device, revised feature access data for the user indicating permission changes for the user;

sending, by the sub-authorization computing device and to the cloud application user interface, the revised feature access data for the user; and

updating, by the cloud application user interface, graphical elements that indicate the permission changes.

18 . The medium of claim 17 , the steps comprising receiving, from the first user, a request to access a feature of the cloud application from an application programming interface (API) and querying the identity provider to determine whether the first user is authorized to access the feature.