Accessing a cloud-based service platform using enterprise application authentication
Systems for managing user-level security in a cloud-based service platform. A server in a cloud-based environment is configured to interface with storage devices that store objects that are accessible over a network by two or more users. An enterprise entity is identified using an enterprise identifier associated with the enterprise, and an application service is associated with an application identifier. An application service request comprising a user identifier and the application identifier is received, and authentication is determined based on the combination of the user identifier and a pre-authenticated application identifier. Once the application service request is authenticated, then specific aspects of the service request are authorized. The integrity of the application identifier is confirmed by locating a secure association of the given application identifier to a pre-shared enterprise identifier. Logging, auditing and other functions can be performed at the user level using the user identifier for user-level tracking.
1. A method comprising:
identifying a server in a cloud-based environment, wherein the server is configured to interface with one or more storage devices associated with a content management service on a content management server, the one or more storage devices storing at least one content object accessible over a network by two or more users,
forming an enterprise identifier associated with an enterprise, an application identifier associated with an application service, and a user identifier associated with an application user, wherein the application user is one of the two or more users;
receiving, over the network, one or more electronic records comprising at least one first service request to the content management server from the application service, wherein the first service request comprises the user identifier and the application identifier;
initiating, on the server, a request that authenticates the application service with the content management service on the content management server based at least in part on the combination of the user identifier and the application identifier received in the first service; and
authorizing the first service request based at least in part on the user identifier received in the first service request.
2. The method of claim 1 , further comprising:
receiving, over the network, one or more electronic records comprising at least one second service request from the application service, wherein the second service request comprises the enterprise identifier and the application identifier;
authenticating the application service based at least in part on the combination of the enterprise identifier and the application identifier received in the second service request; and
authorizing the second service request based at least in part on the enterprise identifier and the application identifier received in the second service request.
3. The method of claim 1 , wherein the authorizing the first service request is based at least in part on the enterprise identifier that is mapped from the application identifier.
4. The method of claim 1 , further comprising issuing an access token to the application service in response to acts of authorizing the first service request.
5. The method of claim 4 , wherein the access token is valid until an expiration time.
6. The method of claim 1 , further comprising:
identifying a shared common user accounts database;
authenticating, using the shared common user accounts database, a first user to access a first application; and
authenticating, using the shared common user accounts database, a second user to access a second application.
7. The method of claim 1 , further comprising creating an application user profile associated with the application user on the server, wherein the application user profile comprises at least the user identifier.
8. The method of claim 1 , further comprising performing auditing operations using the user identifier.
9. The method of claim 1 , wherein the first service request is encrypted with a public-private key pair.
10. The method of claim 1 , wherein the enterprise does not receive a client secret.
11. A computer program product, embodied in a non-transitory computer readable medium, the non-transitory computer readable medium having stored thereon a sequence of instructions which, when stored in memory and executed by a processor causes the processor to perform a set of acts, the acts comprising:
identifying a server in a cloud-based environment, wherein the server is configured to interface with one or more storage devices associated with a content management service on a content management server, the one or more storage devices storing at least one content object accessible over a network by two or more users,
forming an enterprise identifier associated with an enterprise, an application identifier associated with an application service, and a user identifier associated with an application user, wherein the application user is one of the two or more users;
receiving, over the network, one or more electronic records comprising at least one first service request to the content management server from the application service, wherein the first service request comprises the user identifier and the application identifier;
initiating, on the server, a request that authenticates the application service with the content management service on the content management server based at least in part on the combination of the user identifier and the application identifier received in the first service; and
authorizing the first service request based at least in part on the user identifier received in the first service request.
12. The computer program product of claim 11 , further comprising:
receiving, over the network, one or more electronic records comprising at least one second service request from the application service, wherein the second service request comprises the enterprise identifier and the application identifier;
authenticating the application service based at least in part on the combination of the enterprise identifier and the application identifier received in the second service request; and
authorizing the second service request based at least in part on the enterprise identifier and the application identifier received in the second service request.
13. The computer program product of claim 11 , wherein the authorizing the first service request is based at least in part on the enterprise identifier that is mapped from the application identifier.
14. The computer program product of claim 11 , further comprising instructions which, when loaded into the memory and executed by the processor, cause the processor to perform acts of issuing an access token to the application service in response to acts of authorizing the first service request.
15. The computer program product of claim 11 , further comprising instructions which, when loaded into the memory and executed by the processor, cause the processor to perform acts of:
identifying a shared common user accounts database;
authenticating, using the shared common user accounts database, a first user to access a first application; and
authenticating, using the shared common user accounts database, a second user to access a second application.
16. The computer program product of claim 11 , further comprising instructions which, when loaded into the memory and executed by the processor, cause the processor to perform acts of creating an application user profile associated with the application user, wherein the application user profile comprises at least the user identifier.
17. The computer program product of claim 11 , wherein the first service request is encrypted with a public-private key pair.
18. The computer program product of claim 11 , wherein the enterprise does not receive a client secret.
19. A system comprising:
a server in a cloud-based environment, wherein the server is configured to interface with one or more storage devices associated with a content management service on a content management server, the one or more storage devices storing at least one content object accessible over a network by two or more users; and
a processor having instructions which, when loaded into a memory and executed by the processor, cause the processor to perform acts of:
forming an enterprise identifier associated with an enterprise, an application identifier associated with an application service, and a user identifier associated with an application user, wherein the application user is one of the two or more users;
receiving, over the network, one or more electronic records comprising at least one first service request from the application service to the content management server, wherein the first service request comprises the user identifier and the application identifier;
initiating, on the server, an application user access request that authenticates the application service based at least in part on sending the combination of the user identifier and the application identifier received in the first service request to the content management server; and
authorizing the first service request based at least in part on the user identifier received in the first service request.
20. The system of claim 19 , further comprising:
a network port to receive, over the network, one or more electronic records comprising at least one second service request from the application service, wherein the second service request comprises the enterprise identifier and the application identifier; and
a memory to store instructions that when executed by the processor, cause the processor to perform acts of:
authenticating the application service based at least in part on the combination of the enterprise identifier and the application identifier received in the second service request; and
authorizing the second service request based at least in part on the enterprise identifier and the application identifier received in the second service request.
21. A method comprising:
authenticating, using a first authentication method, a server-side collaboration application hosted on a server in a cloud-based environment, wherein the server is configured to interface with one or more storage devices that store at least one content object accessible over a network by two or more users;
authenticating, using a second authentication method, a client-side collaboration application hosted on a client user device, wherein the client user device is configured to interface with the network using a user identifier; and
authorizing a service request from the client-side collaboration application based on a combination of an identifier of the client-side collaboration application and the user identifier, wherein the service request itself is authenticated directly by a content management server,
wherein the first authentication method uses at least one first data item that is not used in the second authentication method, and
wherein the second method uses at least one second data item that is not used in the first authentication method.
22. The method of claim 21 , wherein at least one first data item comprises at least a portion of an enterprise credential, which portion is not passed to the client user device.
23. The method of claim 21 , wherein at least one second data item comprises at least a portion of a user credential, which portion is not passed to the server in the cloud-based environment.
24. The method of claim 23 , wherein the second authentication method comprises:
identifying a shared common user accounts database that comprises at least a portion of a user credential pertaining to a first user and that comprises at least a portion of a user credential pertaining to a second user;
authenticating, using the shared common user accounts database, the first user to access the client-side collaboration application; and
authenticating, using the shared common user accounts database, the second user to access a second client-side collaboration application.