Cross-region trust for a multi-tenant identity cloud service
Embodiments of a multi-tenant cloud system include a first data center adapted to authenticate a first plurality of registered clients and located in a first geographic area, and a second data center adapted to authenticate a second plurality of registered clients and located in a second geographic area that is different from the first geographic area. The first data center receives a request from a first client of the first plurality of registered clients to access a resource of the second data center and validates the request from the first client and issues a global access token. The second data center receives the request with the global access token. A cloud gate at the second data center, based on the global access token, validates the request and provides the resource to the first client.
1. A multi-tenant cloud system comprising:
a first data center adapted to authenticate a first plurality of registered clients and located in a first geographic area, the first data center associated with first resources that are accessed by invoking a Representational State Transfer (REST) application programming interfaces (API) that is associated with each of the first resources, the first data center comprising at least one first hardware processor to implement the authenticate;
a second data center adapted to authenticate a second plurality of registered clients and located in a second geographic area that is different from the first geographic area, the second data center associated with second resources, different than the first resources, that are accessed by invoking the REST API that is associated with each of the second resources, the second data center comprising at least one second hardware processor to implement the authenticate;
the first data center receiving a request from a first client of the first plurality of registered clients to access a second resource of the second resources of the second data center, wherein the first client is registered in the first data center and is not registered in the second data center;
the first data center validating the request from the first client and issuing a global access token;
the second data center receiving the request with the global access token; and
a cloud gate at the second data center, based on the global access token, validating the request and providing the second resource to the first client by invoking the REST API associated with the second resource, wherein the REST APIs associated with the first data center are invokable by the first client without the global access token, and the REST API associated with the second resource is not invokable by the first client without the global access token.
2. The multi-tenant cloud system of claim 1 , wherein the issuing the global access token comprises signing the global access token with a global signing key that is stored at the first data center and the second data center.
3. The multi-tenant cloud system of claim 1 , wherein the issuing the global access token comprises signing the global access token with an signing key retrieved from a central authority using a first authentication key that is stored only at the first data center.
4. The multi-tenant cloud system of claim 1 , where the global access token comprises an OAuth access token with additional token claims comprising a client tenant name, a location identifier and a flag indicating that the OAuth access token is the global access token.
5. The multi-tenant cloud system of claim 1 , wherein issuing the global access token comprises determining if the client has a global role.
6. The multi-tenant cloud system of claim 1 , wherein after validating the request the token is consumed by an authorization filter.
7. The multi-tenant cloud system of claim 1 , wherein the global access token comprises a JavaScript Object Notation (JSON) format.
8. The multi-tenant cloud system of claim 1 , wherein the first data center and the second data center are located on the same control plane.
9. A method of operating a multi-tenant cloud system that comprises a first data center adapted to authenticate a first plurality of registered clients and located in a first geographic area, the first data center associated with first resources that are accessed by invoking a Representational State Transfer (REST) application programming interfaces (API) that is associated with each of the first resources, and a second data center adapted to authenticate a second plurality of registered clients and located in a second geographic area that is different from the first geographic area, the second data center associated with second resources, different than the first resources, that are accessed by invoking REST API that is associated with each of the second resources, the method comprising:
receiving a request at the first data center from a first client of the first plurality of registered clients to access a second resource of the second resources of the second data center, wherein the first client is registered in the first data center and is not registered in the second data center;
validating the request at the first data center from the first client and issuing a global access token;
receiving the request at the second data center with the global access token; and
validating the request and providing the second resource to the first client at a cloud gate at the second data center, based on the global access token, by invoking the REST API associated with the second resource, wherein the REST APIs associated with the first data center are invokable by the first client without the global access token, and the REST API associated with the second resource is not invokable by the first client without the global access token.
10. The method of claim 9 , wherein the issuing the global access token comprises signing the global access token with a global signing key that is stored at the first data center and the second data center.
11. The method of claim 9 , wherein the issuing the global access token comprises signing the global access token with an signing key retrieved from a central authority using a first authentication key that is stored only at the first data center.
12. The method of claim 9 , where the global access token comprises an OAuth access token with additional token claims comprising a client tenant name, a location identifier and a flag indicating that the OAuth access token is the global access token.
13. The method of claim 9 , wherein issuing the global access token comprises determining if the client has a global role.
14. The method of claim 9 , wherein after validating the request the token is consumed by an authorization filter.
15. The method of claim 9 , wherein the global access token comprises a JavaScript Object Notation (JSON) format.
16. The method of claim 9 , wherein the first data center and the second data center are located on the same control plane.
17. A non-transitory computer-readable medium storing instructions which, when executed by at least one of a plurality of processors, cause the processor to operate a multi-tenant cloud system that comprises a first data center adapted to authenticate a first plurality of registered clients and located in a first geographic area, the first data center associated with first resources that are accessed by invoking a Representational State Transfer (REST) application programming interfaces (API) that is associated with each of the first resources, and a second data center adapted to authenticate a second plurality of registered clients and located in a second geographic area that is different from the first geographic area, the second data center associated with second resources, different than the first resources, that are accessed by invoking the REST API that is associated with each of the second resources, the operating comprising:
receiving a request at the first data center from a first client of the first plurality of registered clients to access a second resource of the second resources of the second data center, wherein the first client is registered in the first data center and is not registered in the second data center;
validating the request at the first data center from the first client and issuing a global access token;
receiving the request at the second data center with the global access token; and
validating the request and providing the second resource to the first client at a cloud gate at the second data center, based on the global access token, by invoking the REST API associated with the second resource, wherein the REST APIs associated with the first data center are invokable by the first client without the global access token, and the REST API associated with the second resource is not invokable by the first client without the global access token.
18. The non-transitory computer-readable medium of claim 17 , wherein the issuing the global access token comprises signing the global access token with a global signing key that is stored at the first data center and the second data center.
19. The non-transitory computer-readable medium of claim 17 , wherein the issuing the global access token comprises signing the global access token with an signing key retrieved from a central authority using a first authentication key that is stored only at the first data center.
20. The non-transitory computer-readable medium of claim 17 , where the global access token comprises an OAuth access token with additional token claims comprising a client tenant name, a location identifier and a flag indicating that the OAuth access token is the global access token.