Access control policy management in a computing environment

1. A method of managing access to resources managed by heterogeneous resource servers having different policy document formats in a cloud services environment, the method comprising:

validating, at a resource server endpoint designated by a resource server of the heterogeneous resource servers, a policy document describing access privileges with respect to accessing at least one resource of the resources managed by the resource server, the policy document being a newly authored policy document to be used by authorized end-user computing devices to access the at least one resource;

in response to a determination by the resource server endpoint that the policy document is valid, causing the policy document to be stored by an identity and access management (IAM) service in a datastore;

in response to a determination by the resource server endpoint that the policy document is invalid, causing an indication that the policy document is invalid to be generated by the IAM service; and

after the policy document has been validated by the resource server endpoint and stored in the datastore, sending an access token having the policy document from the IAM service to an end-user computing device to be transmitted to the resource server endpoint for access to the at least one resource.

2. The method of claim 1 , further comprising:

prior to validating the policy document, registering at the IAM service, metadata that includes a scope and the resource server endpoint of the resource server; and

prior to validating the policy document, obtaining the policy document at the IAM service.

3. The method of claim 1 , further comprising:

receiving, at the resource server endpoint, the policy document from the IAM service.

4. The method of claim 1 , further comprising:

receiving, at the resource server endpoint, a policy validation request having the policy document, an identity associated with a user or group, a scope, and a token for an author of the policy document.

5. The method of claim 4 , wherein receiving, at the resource server endpoint, the policy validation request comprises receiving, at the resource server endpoint, the policy validation request from the IAM service.

6. The method of claim 1 , further comprising:

receiving, at the resource server endpoint, the access token having the policy document from the end-user computing device; and

validating, by the resource server, the access token.

7. The method of claim 6 , wherein validating, by the resource server, the access token comprises verifying, by the resource server, a signature in the access token using a public key of the IAM service.

8. The method of claim 6 , further comprising in response to a determination by the resource server that the access token is valid, providing resource access based on access privileges in the access token.

9. A non-transitory computer readable medium comprising instructions, which when executed in a computer system, causes the computer system to carry out a method of managing access to resources managed by heterogeneous resource servers having different policy document formats in a cloud services environment, comprising:

validating, at a resource server endpoint designated by a resource server of the heterogeneous resource servers, a policy document describing access privileges with respect to accessing at least one resource of the resources managed by the resource server, the policy document being a newly authored policy document to be used by authorized end-user computing devices to access the at least one resource;

in response to a determination by the resource server endpoint that the policy document is valid, causing the policy document to be stored by an identity and access management (IAM) service in a datastore;

in response to a determination by the resource server endpoint that the policy document is invalid, causing an indication that the policy document is invalid to be generated by the IAM service; and

after the policy document has been validated by the resource server endpoint and stored in the datastore, sending an access token having the policy document from the IAM service to an end-user computing device to be transmitted to the resource server endpoint for access to the at least one resource.

10. The non-transitory computer readable medium of claim 9 , wherein the method further comprises:

prior to validating the policy document, registering at the IAM service, metadata that includes a scope and the resource server endpoint of the resource server; and

prior to validating the policy document, obtaining the policy document at the IAM service.

11. The non-transitory computer readable medium of claim 9 , wherein the method further comprises:

receiving, at the resource server endpoint, the policy document from the IAM service.

12. The non-transitory computer readable medium of claim 9 , wherein the method further comprises:

receiving, at the resource server endpoint, a policy validation request having the policy document, an identity associated with a user or group, a scope, and a token for an author of the policy document.

13. The non-transitory computer readable medium of claim 12 , wherein receiving, at the resource server endpoint, the policy validation request comprises receiving, at the resource server endpoint, the policy validation request from the IAM service.

14. The non-transitory computer readable medium of claim 9 , wherein the method further comprises:

receiving, at the resource server endpoint, the access token having the policy document from the end-user computing device; and

validating, by the resource server, the access token.

15. The non-transitory computer readable medium of claim 14 , wherein validating, by the resource server, the access token comprises verifying, by the resource server, a signature in the access token using a public key of the IAM service.

16. The non-transitory computer readable medium of claim 14 , wherein the method further comprises in response to a determination by the resource server that the access token is valid, providing resource access based on access privileges in the access token.

17. A computer system comprising:

memory; and

a processor configured to:

validate, at a resource server endpoint designated by a resource server of heterogeneous resource servers, a policy document describing access privileges with respect to accessing at least one resource of resources managed by the resource server;

in response to a determination by the resource server endpoint that the policy document is valid, cause the policy document to be stored by an identity and access management (IAM) service in a datastore;

in response to a determination by the resource server endpoint that the policy document is invalid, cause an indication that the policy document is invalid to be generated by the IAM service; and

after the policy document has been validated by the resource server endpoint and stored in the datastore, send an access token having the policy document from the IAM service to an end-user computing device to be transmitted to the resource server endpoint for access to the at least one resource.

18. The computer system of claim 17 , the processor is further configured to:

prior to validating the policy document, register at the IAM service, metadata that includes a scope and the resource server endpoint of the resource server; and

prior to validating the policy document, obtain the policy document at the IAM service.

19. The computer system of claim 17 , the processor is further configured to:

receive, at the resource server endpoint, a policy validation request having the policy document, an identity associated with a user or group, a scope, and a token for an author of the policy document.

20. The computer system of claim 17 , the processor is further configured to:

receive, at the resource server endpoint, the access token having the policy document from the end-user computing device; and

validate, by the resource server, the access token.