Identity and policy enforced inter-cloud and intra-cloud channel

1. A method, comprising:

resolving, by executable instructions that execute on a hardware processor from a non-transitory computer-readable storage medium, a channel identity for a communication channel for enforcing a policy by obtaining the channel identity as an identity-provider assigned channel identity from an identity provider that authenticates the communication channel in order to process the communication channel as a secure controlled and monitored communication channel and obtaining the policy based on the identity-provider assigned channel identity;

enforcing, by the executable instructions that execute on the hardware processor, the policy for messages being passed: to, over, and from the communication channel based on the channel identity and the messages; and

restricting select ones of the messages from being passed to, over, and from the communication channel and only permitting particular ones of the messages to be processed on the communication channel.

2. The method of claim 1 , wherein resolving further includes establishing the channel identity over a second communication channel that is different from the communication channel with the identity provider.

3. The method of claim 2 , wherein establishing further includes providing the channel identity to a channel process of a cloud where the messages are received and sent from.

4. The method of claim 3 , wherein providing further includes providing the channel identity for the communication channel and providing the policy to the channel process over the second channel.

5. The method of claim 1 , wherein enforcing further includes enforcing the policy when passing the messages within a cloud between intra-cloud processes.

6. The method of claim 1 , wherein enforcing further includes enforcing the policy when passing the messages between inter-cloud processes of multiple clouds.

7. The method of claim 1 , wherein enforcing further includes enforcing the policy when passing the messages within a first cloud between intra-cloud processes and enforcing the policy when passing the messages between inter-cloud processes of the first cloud and at least one second cloud.

8. The method of claim 1 , wherein enforcing further includes enforcing identity-based restrictions on the messages in accordance with the policy.

9. The method of claim 8 , wherein enforcing further includes blocking any of the messages from being passed over the communication when particular messages fail to conform with the identity-based restrictions.

10. A method, comprising:

intercepting, by executable instructions that execute on a hardware processor from a non-transitory computer-readable storage medium, a message within a cloud that is being attempted to be passed from a sender and is directed to a receiver;

authenticating, by the executable instructions that execute on the hardware processor, the message based on at least:

a message identity for the message, a sender identity for the sender, and a receiver identity for the receiver; and

passing, by the executable instructions that execute on the hardware processor, the message over a pre-designated communication channel within the cloud for communication to the receiver when the message is successfully authenticated based on a channel identity assigned to the pre-designated communication channel, wherein only select messages are permitted to be processed over the pre-designated communication channel.

11. The method of claim 10 , wherein intercepting further includes intercepting the message over a port associated with inter-cloud communication.

12. The method of claim 10 , wherein intercepting further includes intercepting the message over a port associated with intra-cloud communication within the cloud.

13. The method of claim 10 , wherein intercepting further includes detecting a raised event within the cloud and identifying from the event whether the message and the sender are associated with the cloud or with an external cloud that is external to the cloud.

14. The method of claim 10 , wherein authenticating further includes obtaining the pre-designated communication channel in response to successfully authenticating the message.

15. The method of claim 10 , wherein passing further includes logging metadata associated with successfully authenticating the message, the message identifier, the sender identifier, the receiver identifier, and a channel identifier for the pre-designated communication channel after passing the message.

16. The method of claim 10 , wherein passing further includes directing the message over the pre-defined communication channel to a separate processing instance of the method associated with the sender.

17. The method of claim 10 further comprising, publishing capabilities associated with the authentication processing to other external cloud processes.

18. A system, comprising:

a processor;

a non-transitory computer-readable storage medium having executable instructions;

the executable instructions execute on the processor from the non-transitory computer-readable storage medium to perform processing to:

enforce identity-based authentication on intra-cloud messages and inter-cloud messages based on channel identities assigned to communication channels where the intra-cloud messages and inter-cloud messages are being passed and only permit select ones of the intra-cloud messages and the inter-cloud messages to be processed over the communication channels.

19. The system of claim 18 , wherein the executable instructions are further configured to: interact with other instances of the executable instructions independently, each instance of the executable instructions processes a different processor from the processor of the system.

20. The system of claim 18 , wherein the executable instructions are further configured to:

audit each of the messages based on enforcement of an audit policy.