System and method for group of groups single sign-on demarcation based on first user login
Methods and systems for access in a management controller group hierarchy may involve receiving a request for a user at an information handling system, determining whether a link of trust is established, and validating the single sign-on request. The request may be to authenticate the user for access using a single sign-on token. Determination of whether the link of trust is established may be based on an initial login location stored in the single sign-on token. Validation of the single sign-on token may be based on a determination that the link of trust is established.
1. A method for access in a management controller group hierarchy, comprising:
receiving a request for a user at a first management controller of a first information handling system in a management controller group hierarchy, the request to authenticate the user for access using a single sign-on token and the management controller group hierarchy formed with two or more levels, each level formed with one or more groups corresponding to one or more management controllers of one or more information handling systems;
determining whether a link of trust is established based on an initial login location stored in the single sign-on token;
validating the request to authenticate the user for access using the single sign-on token based on a determination that the link of trust is established;
determining whether the initial login location is recognized;
based on a determination that the initial login location is not recognized:
granting the user access to view information about an aggregate group in the management controller group hierarchy, the aggregate group including a first local group in the management controller group hierarchy; and
denying the user access to the first local group of the aggregate group.
2. The method of claim 1 , further comprising:
receiving a re-authenticated single sign-on token from a controlling member of a second local group in the management controller group hierarchy, the re-authenticated single sign-on token received after a request to elevate privileges is received and the second local group not including the first management controller; and
granting the user full access to the second local group of the aggregate group based on receiving the re-authenticated single sign-on token from the controlling member of the second local group.
3. The method of claim 1 , further comprising:
receiving a request to elevate privileges of the user to enable access to a second local group in the management controller group hierarchy, the second local group in the management controller group hierarchy not including the first management controller of the first information handling system;
redirecting the request to elevate privileges to a controlling member of the second local group; and
receiving a re-authenticated single sign-on token back from the controlling member of the second local group.
4. The method of claim 3 , further comprising:
determining whether a login location stored in the re-authenticated single sign-on token corresponds to a second management controller that manages the aggregate group in the management controller group hierarchy, the aggregate group including the first management controller of the first information handling system that received the request to authenticate the user for access; and
granting the user full access to the first local group and second local group based on a determination that the login location stored in the re-authenticated single sign-on token corresponds to the second management controller that manages the aggregate group in the management controller group hierarchy.
5. The method in claim 1 , wherein determining whether the link of trust is established based on the initial login location is based on a determination whether the management controller of the first information handling system and a second management controller of a second information handling system are part of the same local group in the management controller group hierarchy.
6. An information handling system, comprising:
a processor subsystem comprising a primary processor having access to a first memory;
a management controller comprising a secondary processor having access to a second memory, the second memory including an embedded storage partition and the second memory storing instructions executable by the secondary processor to:
receive a request for a user at the management controller of the information handling system in a management controller group hierarchy, the request to authenticate the user for access using a single sign-on token and the management controller group hierarchy formed with two or more levels, each level formed with one or more groups corresponding to one or more management controllers of one or more information handling systems;
determine whether a link of trust is established based on an initial login location stored in the single sign-on token;
validate request to authenticate the user for access using the single sign-on token based on a determination that the link of trust is established;
determine whether the initial login location is recognized;
based on a determination that the initial login location is not recognized:
grant the user access to view information about an aggregate group in the management controller group hierarchy, the aggregate group including a first local group in the management controller group hierarchy; and
deny the user access to the first local group of the aggregate group.
7. The information handling system of claim 6 , further comprising instructions executable by the secondary processor to:
receive a re-authenticated single sign-on token from a controlling member of a second local group in the management controller group hierarchy, the re-authenticated single sign-on token received after a request to elevate privileges is received and the second local group not including the management controller; and
grant the user full access to the second local group of the aggregate group based on receipt of the re-authenticated single sign-on token from the controlling member of the second local group.
8. The information handling system of claim 6 , further comprising instructions executable by the secondary processor to:
receive a request to elevate privileges of the user to enable access to a second local group in the management controller group hierarchy, the second local group in the management controller group hierarchy not including the management controller of the information handling system;
redirect the request to elevate privileges to a controlling member of the second local group; and
receive a re-authenticated single sign-on token back from the controlling member of the second local group.
9. The information handling system of claim 8 , further comprising instructions executable by the secondary processor to:
determine whether a login location stored in the re-authenticated single sign-on token corresponds to another management controller that manages the aggregate group in the management controller group hierarchy, the aggregate group including the management controller of the information handling system that received the request to authenticate the user for access; and grant the user full access to the first local group and the second local group based on a determination that the login location stored in the re-authenticated single sign-on token corresponds to the management controller that manages the aggregate group in the management controller group hierarchy.
10. The information handling system of claim 6 , wherein a determination of whether the link of trust is established based on the initial login location is based on a determination whether the management controller of the information handling system and a target management controller of another second information handling system are part of the same local group in the management controller group hierarchy.
11. The information handling system of claim 6 , wherein the initial login location stored in the single sign-on token indicates a service tag that corresponds to an initial management controller of an initial information handling system that corresponds to the initial login location.
12. A management controller for an information handling system having a primary processor and a primary memory, the management controller comprising a secondary processor having access to a secondary memory, the secondary memory including an embedded storage partition and the secondary memory storing instructions executable by the secondary processor to:
receive a request for a user at the management controller of the information handling system in a management controller group hierarchy, the request to authenticate the user for access using a single sign-on token and the management controller group hierarchy formed with two or more levels, each level formed with one or more groups corresponding to one or more management controllers of one or more information handling systems;
determine whether a link of trust is established based on an initial login location stored in the single sign-on token;
validate the request to authenticate the user for access using the single sign-on token based on a determination that the link of trust is established;
determine whether the initial login location is recognized;
based on a determination that the initial login location is not recognized:
grant the user access to view information about an aggregate group in the management controller group hierarchy, the aggregate group including a first local group in the management controller group hierarchy; and
deny the user access to the first local group included in the aggregate group.
13. The management controller of claim 12 , further comprising instructions executable by the secondary processor to:
receive a re-authenticated single sign-on token from a controlling member of a second local group in the management controller group hierarchy, the re-authenticated single sign-on token received after a request to elevate privileges is received and the second local group not including the management controller; and
grant the user full access to the second local group of the aggregate group based on receipt of the re-authenticated single sign-on token from the controlling member of the second local group.
14. The management controller of claim 12 , further comprising instructions executable by the secondary processor to:
receive a request to elevate privileges of the user to enable access to a second local group in the management controller group hierarchy, the second local group in the management controller group hierarchy not including the management controller of the information handling system;
redirect the request to elevate privileges to a controlling member of the second local group; and
receive a re-authenticated single sign-on token back from the controlling member of the second local group.
15. The management controller of claim 14 , further comprising instructions executable by the secondary processor to:
determine whether a login location stored in the re-authenticated single sign-on token corresponds to another management controller that manages the aggregate group in the management controller group hierarchy, the aggregate group including the management controller of the information handling system that received the request to authenticate the user for access; and
grant the user full access to the first local group and the second local group based on a determination that the login location stored in the re-authenticated single sign-on token corresponds to the management controller that manages the aggregate group in the management controller group hierarchy.
16. The management controller of claim 12 , wherein a determination of whether the link of trust is established based on the initial login location is based on a determination whether the management controller of the information handling system and a target management controller of another information handling system are part of the same local group in the management controller group hierarchy.
17. The management controller of claim 12 , wherein the initial login location stored in the single sign-on token indicates a service tag that corresponds to an initial management controller of an initial information handling system that corresponds to the initial login location.