Dynamic authorization in a multi-tenancy environment via tenant policy profiles
View Patent ↗In one example, a method for managing user access is performed by or at the direction of an application, and includes receiving a token from an authentication service, and the token includes an application role and associated privilege mask. An authentication request is then received from a sender seeking access to an application. Information in the authentication request is compared with the token, and the authentication request is approved when the information in the authentication request matches the token. Alternatively, access to the application is denied when the information in the authentication request does not match the token.
1. A method, comprising:
managing user access to data contained in a computing system, by performing the following operations:
with an authentication service, creating a set of tenant characteristics and transmitting the tenant characteristics to an authorization service;
with the authorization service:
comparing the tenant characteristics of the set of tenant characteristics to application roles included in respective application authorization profiles, the application authorization profiles each corresponding to a different respective application, wherein comparison of tenant characteristics to application roles is performed dynamically in response to a change in one or both of a tenant characteristic and an application authorization profile;
identifying a match between the tenant characteristics and a plurality of application roles;
extracting matching application roles and associated respective privilege masks from the application authorization profiles; and
returning the extracted application roles and associated privilege masks to the authentication service; and
with the authentication service:
for each extracted application role and associated privilege mask, generating a respective token, such that one or more tokens are generated; and
returning the one or more tokens to a tenant administrator, wherein the one or more tokens are usable by the tenant administrator to authenticate one or more tenants for access to data and/or functions embraced by a tenant environment.
2. The method as recited in claim 1 , wherein the authorization service enables single sign-on (SSO) functionality that enables a tenant to gain access to multiple independent applications.
3. The method as recited in claim 1 , wherein the tenant characteristics include a user unique identifier, and identification of one or more groups to which the tenant belongs.
4. The method as recited in claim 1 , further comprising registering each application authorization profile with the authorization service, wherein only one application authorization profile is registered for each application.
5. The method as recited in claim 1 , wherein one of the applications has a plurality of versions, and the method further comprising registering a respective application authorization profile for each version with the authorization service.
6. The method as recited in claim 1 , wherein the authorization service is not application-specific.
7. The method as recited in claim 1 , wherein each of the tokens that includes tenant authorization information and an associated privilege mask enables the tenant administrator to restrict user access such that user access is limited to data and/or functionality associated with an intra-application tenancy defined by the tenant environment.
8. The method as recited in claim 1 , wherein a first one of the application authorization profiles corresponds to a first application, and a first one of the tokens enables access control to be performed so as to restrict a tenant to only partial access to that application.
9. The method as recited in claim 1 , further comprising modifying access privileges of a tenant by:
changing the content of a first application authorization profile;
modifying a token based on the changes to the content of the first application authorization profile; and
transmitting the modified token to the tenant administrator.
10. A non-transitory storage medium having stored therein computer-executable instructions which are executable by one or more hardware processors to perform:
managing user access to data contained in a computing system, by performing operations comprising:
with an authentication service, creating a set of tenant characteristics and transmitting the tenant characteristics to an authorization service;
with the authorization service:
comparing the tenant characteristics of the set of tenant characteristics to application roles included in respective application authorization profiles, the application authorization profiles each corresponding to a different respective application, wherein comparison of tenant characteristics to application roles is performed dynamically in response to a change in one or both of a tenant characteristic and an application authorization profile;
identifying a match between the tenant characteristics and a plurality of application roles;
extracting matching application roles and associated respective privilege masks from the application authorization profiles; and
returning the extracted application roles and associated privilege masks to the authentication service; and
with the authentication service:
for each extracted application role and associated privilege mask, generating a respective token, such that one or more tokens are generated; and
returning the one or more tokens to a tenant administrator, wherein the one or more tokens are usable by the tenant administrator to authenticate one or more tenants for access to data and/or functions embraced by a tenant environment.
11. The non-transitory storage medium as recited in claim 10 , wherein the authorization service enables single sign-on (SSO) functionality that enables a tenant to gain access to multiple independent applications.
12. The non-transitory storage medium as recited in claim 10 , wherein the tenant characteristics include a user unique identifier, and identification of one or more groups to which the tenant belongs.
13. The non-transitory storage medium as recited in claim 10 , wherein the operations further comprise registering each application authorization profile with the authorization service, wherein only one application authorization profile is registered for each application.
14. The non-transitory storage medium as recited in claim 10 , wherein one of the applications has a plurality of versions, and the operations further comprise registering a respective application authorization profile for each version with the authorization service.
15. The non-transitory storage medium as recited in claim 10 , wherein the authorization service is not application-specific.
16. The non-transitory storage medium as recited in claim 10 , wherein each of the tokens that includes tenant authorization information and an associated privilege mask enables the tenant administrator to restrict user access such that user access is limited to data and/or functionality associated with an intra-application tenancy defined by the tenant environment.
17. The non-transitory storage medium as recited in claim 10 , wherein a first one of the application authorization profiles corresponds to a first application, and a first one of the tokens enables access control to be performed so as to restrict a tenant to only partial access to that application.
18. The non-transitory storage medium as recited in claim 10 , wherein the operations further comprise modifying access privileges of a tenant by:
changing the content of a first application authorization profile;
modifying a token based on the changes to the content of the first application authorization profile; and
transmitting the modified token to the tenant administrator.