Proxy-controlled request routing
When a user sends a request to access an asset or resource, for example a program code file or a media file, the access request can be processed by a proxy device. The proxy can use directory information obtained from a directory, for example a company-wide Lightweight Directory Access Protocol (LDAP) directory, to determine whether or not the request is from an authorized network user listed in the directory. The proxy can use management information obtained from another database to determine roles, subordinate assignment information, and access authorization information associated with the requesting user. The proxy can conditionally route the request to a resource host based on the directory information and the management information. The proxy can also transform a resource returned in response to the request by using pipeline language parameters included in a URL associated with the access request.
1. A system comprising:
a proxy device coupled to a plurality of user devices, at least one directory service, and a relay device;
the proxy device configured to:
receive an access request from a user of at least one of the plurality of user devices, the access request including a request to access at least one resource available from a resource host;
obtain directory information associated with the user from the at least one directory service;
obtain user management information associated with the user from the relay device, the user management information including role information indicating one or more roles assigned to the user, and access authorization information indicating resources to which the user has access;
determine whether the user is an authorized network user based, at least in part, on the directory information; and
conditionally route the access request to the resource host based, at least in part, on both the directory information indicating authorization to access the network, and the user management information indicating that the user is authorized to access the at least one resource available from a resource host.
2. The system of claim 1 , wherein the at least one directory service further comprises:
a global directory service storing global directory information associated with a global network shared by a plurality of entities; and
a plurality of local directory services storing local directory information associated with internal networks associated with individual entities of the plurality of entities.
3. The system of claim 2 , wherein the global directory service is configured to:
obtain and store at least a portion of the local directory information from at least two of the plurality of local directory services; and
provide the local directory information, as at least a portion of the directory information, in response to a request by the proxy device.
4. The system of claim 1 , wherein the user management information further includes:
subordinate user information indicating subordinate users assigned to the user; and
source-of-rights information indicating whether access authorizations of the user were granted by another user.
5. The system of claim 4 , wherein the proxy device is further configured to:
use the role information and the subordinate user information to determine whether the user has permissions to grant another user access to the at least one resource available from a resource host.
6. The system of claim 1 , wherein the proxy device is further configured to:
receive, from the device hosting the at least one resource, a resource in response to the access request;
determine, based on pipeline language parameters associated with the access request, whether to generate a transformed resource for delivery to the use in response to the access request;
conditionally generate the transformed resource; and
transmit one of the resource or the transformed resource to the user.
7. The system of claim 1 , wherein:
subsequent to the access request being routed to the resource host, at least some communications between the resource host and the at least one of the plurality of user devices is conducted without intervention by the proxy device.
8. A method comprising:
receiving, at a proxy device, an access request from a user of at least one of a plurality of user devices, the access request including a request to access at least one resource available from a resource host;
obtaining, in response to a directory request from the proxy device, directory information associated with the user from at least one directory service;
obtaining user management information associated with the user from a relay device, the user management information including role information indicating one or more roles assigned to the user, and access authorization information indicating resources to which the user has access;
determining whether the user is an authorized network user based, at least in part, on the directory information; and
conditionally routing the access request to the resource host based, at least in part, on both the directory information indicating authorization to access the network, and the user management information indicating that the user is authorized to access the at least one resource available from a resource host.
9. The method of claim 8 , wherein obtaining directory information comprises:
obtaining directory information from one of a global directory service storing global directory information associated with a global network shared by a plurality of entities, or at least one of a plurality of local directory services storing local directory information associated with internal networks associated with individual entities of the plurality of entities.
10. The method of claim 8 , wherein:
the user management information includes information indicating which directory service the proxy device should contact for directory information; and
obtaining directory information includes sending the directory request to the directory service indicated by the user management information.
11. The method of claim 8 , wherein the user management information further includes:
subordinate user information indicating subordinate users assigned to the user; and
source-of-rights information indicating whether access authorizations of the user were granted by another user.
12. The method of claim 11 , the method further comprising:
using the role information and the subordinate user information to determine whether the user has permissions to grant another user access to the at least one resource available from a resource host.
13. The method of claim 8 , wherein the conditionally routing further includes:
extracting and storing pipeline language parameters associated with the access request.
14. The method of claim 13 , the method further comprising:
receiving, from the device hosting the at least one resource, a resource in response to the access request;
comparing characteristics of the resource to characteristics indicated by the pipeline language parameters;
generating a transformed from the resource, based at least in part on the comparing; and
transmitting the transformed resource to the user.
15. A proxy device comprising:
a processor and associated memory;
a network interface coupled to the processor, the network interface configured to communicate via a communications network with:
at least one directory server storing directory information;
a computing device used by at least one of a plurality of users;
a relay device storing user management information, the user management information including role information indicating one or more roles assigned to the user, and access authorization information indicating resources to which the user has access;
the processor and associated memory configured to:
receive an access request from a user of the computing device used by the at least one of the plurality of users, the access request including a request to access at least one resource available from a resource host;
obtain directory information associated with the user from the at least one directory server;
obtain user management information associated with the user from the relay device;
determine whether the user is an authorized network user based, at least in part, on the directory information; and
conditionally route the access request to the resource host based, at least in part, on both the directory information indicating authorization to access the network, and the user management information indicating that the user is authorized to access the at least one resource available from a resource host.
16. The proxy device of claim 15 , wherein the at least one directory server comprises:
a global directory server storing global directory information associated with a global network shared by a plurality of entities; and
a plurality of local directory servers storing local directory information associated with internal networks associated with individual entities of the plurality of entities.
17. The proxy device of claim 16 , wherein the global directory server is configured to:
obtain and store at least a portion of the local directory information from at least two of the plurality of local directory servers; and
provide the local directory information, as at least a portion of the directory information, in response to a request by the proxy device.
18. The proxy device of claim 15 , wherein the user management information further includes:
subordinate user information indicating subordinate users assigned to the user; and
source-of-rights information indicating whether access authorizations of the user were granted by another user.
19. The proxy device of claim 18 , wherein the processor and associated memory are further configured to:
determine, using the role information and the subordinate user information, whether the user is prohibited from granting another user access to the at least one resource.
20. The proxy device of claim 15 , wherein the processor and associated memory are further configured to:
extract parameters from a network address associated with the access request;
store the parameters;
receive the at least one resource, from the device hosting the at least one resource, in response to the access request being routed to the resource host;
generate a transformed resource by altering the resource using the parameters; and
transmit the transformed resource to the user.