Secure identity propagation in a cloud-based computing environment
The present disclosure describes methods, systems, and computer program products for providing secure identity propagation in a cloud-based computing environment. One computer-implemented method includes receiving, from a user, a first security response message, transmitting, to the user in response to receiving the first security response message, a second security response message, wherein the second security response message comprises a Token Granting Token (TGT), receiving, from a cloud application, a Service Token (ST) request, wherein the ST request comprises the TGT, verifying the ST request based on the TGT, generating, in response to the verifying, a ST, wherein the ST is used to validate an access request to access a backend system, and transmitting the ST to the cloud application.
1. A method, comprising:
receiving, from a user application and at a cloud-based security token service (STS) executing in the same cloud domain name server (DNS) domain as a cloud application a first security response message used to generate a Token Granting Token (TGT) for generating a Service Token (ST), wherein the user application is external to the cloud DNS domain, and wherein the first security response message is generated externally to the cloud DNS domain by an Identity Provider (IDP) after successful verification of the user application following an attempted access by the user application of a protected resource in the cloud application;
transmitting, from the STS and to the user application in response to receiving the first security response message, a second security response message, wherein the second security response message is generated by the STS, wherein the second security response message comprises the TGT, and wherein the TGT includes a unique identifier of the TGT and a unique identifier of the cloud application;
receiving, at the STS and from the cloud application, a ST request, wherein the ST request comprises the TGT received from the user application;
verifying, at the STS, the ST request based on the TGT;
generating, at the STS and in response to the verifying, a ST, wherein the ST is used to validate an access request to access a backend system; and
transmitting the ST from the STS to the cloud application.
2. The method of claim 1 , wherein the TGT comprises a TGT digital signature, and wherein the verification of the ST request is based on the TGT digital signature.
3. The method of claim 2 , wherein the TGT further comprises a lifetime parameter, and wherein the verification is further based on the lifetime parameter.
4. The method of claim 1 , wherein the ST comprises a ST digital signature that is used in validating the access request.
5. The method of claim 4 , wherein the ST further comprises a lifetime parameter, and wherein the lifetime parameter is used in the validation.
6. The method of claim 1 , wherein the second security response message is transmitted from a cloud platform that hosts the cloud application.
7. The method of claim 1 , wherein the first and the second security response messages are formatted according to a Security Assertion Markup Language (SAML) specification.
8. A system, comprising:
a memory;
at least one hardware processor interoperably coupled with the memory and configured to:
receive, from a user application and at a cloud-based security token service (STS) executing in the same cloud domain name server (DNS) domain as a cloud application a first security response message used to generate a Token Granting Token (TGT) for generating a Service Token (ST), wherein the user application is external to the cloud DNS domain, and wherein the first security response message is generated externally to the cloud DNS domain by an Identity Provider (IDP) after successful verification of the user application following an attempted access by the user application of a protected resource in the cloud application;
transmit, from the STS and to the user application in response to receiving the first security response message, a second security response message, wherein the second security response message is generated by the STS, wherein the second security response message comprises the TGT, and wherein the TGT includes a unique identifier of the TGT and a unique identifier of the cloud application;
receive, at the STS and from the cloud application, a ST request, wherein the ST request comprises the TGT received from the user application;
verify, at the STS, the ST request based on the TGT;
generate, at the STS and in response to the verifying, a ST, wherein the ST is used to validate an access request to access a backend system; and
transmit the ST from the STS to the cloud application.
9. The system of claim 8 , wherein the TGT comprises a TGT digital signature, and wherein the verification of the ST request is based on the TGT digital signature.
10. The system of claim 9 , wherein the TGT further comprises a lifetime parameter, and wherein the verification is further based on the lifetime parameter.
11. The system of claim 8 , wherein the ST comprises a ST digital signature that is used in validating the access request.
12. The system of claim 11 , wherein the ST further comprises a lifetime parameter, and wherein the lifetime parameter is used in the validation.
13. The system of claim 8 , wherein the second security response message is transmitted from a cloud platform that hosts the cloud application.
14. The system of claim 8 , wherein the first and the second security response messages are formatted according to a Security Assertion Markup Language (SAML) specification.
15. A non-transitory, computer-readable medium storing computer-readable instructions for secure identity propagation, the instructions executable by a computer and configured to:
receive, from a user application and at a cloud-based security token service (STS) executing in the same cloud domain name server (DNS) domain as a cloud application a first security response message used to generate a Token Granting Token (TGT) for generating a Service Token (ST), wherein the user application is external to the cloud DNS domain, and wherein the first security response message is generated externally to the cloud DNS domain by an Identity Provider (IDP) after successful verification of the user application following an attempted access by the user application of a protected resource in the cloud application;
transmit, from the STS and to the user application in response to receiving the first security response message, a second security response message, wherein the second security response message is generated by the STS, wherein the second security response message comprises the TGT, and wherein the TGT includes a unique identifier of the TGT and a unique identifier of the cloud application;
receive, at the STS and from the cloud application, a ST request, wherein the ST request comprises the TGT received from the user application;
verify, at the STS, the ST request based on the TGT;
generate, at the STS and in response to the verifying, a ST, wherein the ST is used to validate an access request to access a backend system; and
transmit the ST from the STS to the cloud application.
16. The medium of claim 15 , wherein the TGT comprises a TGT digital signature, and wherein the verification of the ST request is based on the TGT digital signature.
17. The medium of claim 16 , wherein the TGT further comprises a lifetime parameter, and wherein the verification is further based on the lifetime parameter.