Access control for a computing system
An exemplary access control system controls access to a computing system such as a data storage system. For example, the exemplary access control system includes a remote management system that receives a request to operate on an element of the computing system and generates a message based on the request and a first token for the remote management system that is associated with the request. The message includes data representative of a second token for the remote management system. The remote management system signs the message and transmits the signed message to the computing system, which is configured to verify and use the signed message, including the second token included in the signed message, to obtain and use a local access token to access and operate on the element in accordance with the request.
1. A method comprising:
authenticating, by a remote management system implemented in a remote management computing domain, a user requesting access to the remote management system by way of a user computing device, the authenticating including identifying an identifier token for the user;
using, by the remote management system, the identifier token for the user to obtain, from a token exchange server within the remote management computing domain, a first token for the remote management system; and
providing, by the remote management system, the first token for the remote management system to the user computing device;
receiving, by the remote management system from the user computing device, a request to perform an operation on a storage element of a data storage system implemented in a storage system computing domain, the request including the first token for the remote management system;
generating, by the remote management system based on the request including the first token for the remote management system, a message that includes data representative of
the requested operation on the storage element, and
a second token for the remote management system;
signing, by the remote management system, the message; and
transmitting, by the remote management system, the signed message to the data storage system, the signed message configured to be verified and used by the data storage system to obtain a local access token configured to be used to access the storage element and perform the requested operation on the storage element.
2. The method of claim 1 , wherein the generating of the message comprises using the first token for the remote management system to obtain, from the token exchange server, the second token for the remote management system.
3. The method of claim 1 , wherein the generating of the message comprises:
using the first token for the remote management system to invoke an application program interface, of the remote management system, for remotely accessing the storage element of the data storage system from the remote management system; and
obtaining, by the application program interface from the token exchange server, the second token for the remote management system.
4. The method of claim 3 , wherein:
the application program interface is configured for accessing services of the remote management system; and
the services of the remote management system comprise a service for remotely accessing the storage element of the data storage system from the remote management system.
5. The method of claim 1 , wherein the second token for the remote management system comprises data indicating the storage element of the data storage system to be a target of the requested operation.
6. The method of claim 1 , wherein the signing of the message comprises:
invoking a signing server implemented in the remote management computing domain to generate a signature based on a private key; and
signing the message with the signature.
7. The method of claim 1 , further comprising:
receiving, by the data storage system, the signed message that includes data representative of the requested operation on the storage element and the second token for the remote management system;
verifying, by the data storage system, that the signed message is from the remote management system;
using, by the data storage system, the second token for the remote management system to obtain the local access token from a local token exchange server implemented in the storage system computing domain; and
using, by the data storage system, the local access token to access the storage element and perform the requested operation on the storage element.
8. The method of claim 7 , wherein the using of the local access token to access the storage element comprises:
using the local access token to invoke an application program interface of the data storage system; and
the invoked application program interface of the data storage system executing to perform the requested operation on the storage element.
9. A system comprising:
a memory storing instructions;
a processor communicatively coupled to the memory and configured to execute the instructions to:
authenticate, at a remote management system implemented in a remote management computing domain, a user requesting access to the remote management system by way of a user computing device, the authenticating including identifying an identifier token for the user;
use the identifier token for the user to obtain, from a token exchange server within the remote management computing domain, the first token for the remote management system;
provide the first token for the remote management system to the user computing device;
receive, at the remote management system and from the user computing device, a request to perform an operation on an element of a computing system implemented in a computing system domain, the request including the first token for the remote management system;
generate, based on the request including the first token for the remote management system, a message that includes data representative of
the requested operation on the element, and
a second token for the remote management system;
sign the message; and
transmit the signed message from the remote management system to the computing system, the signed message configured to be verified and used by the computing system to obtain a local access token configured to be used to access the element and perform the requested operation on the element.
10. The system of claim 9 , wherein the generating of the message comprises using the first token for the remote management system to obtain, from the token exchange server, the second token for the remote management system.
11. The system of claim 9 , wherein the generating of the message comprises:
using the first token for the remote management system to invoke an application program interface, of the remote management system, for remotely accessing the element of the computing system from the remote management system; and
obtaining, by the application program interface from the token exchange server, the second token for the remote management system.
12. The system of claim 11 , wherein:
the application program interface is configured for accessing services of the remote management system; and
the services of the remote management system comprise a service for remotely accessing the element of the computing system from the remote management system.
13. The system of claim 9 , wherein the second token for the remote management system comprises data indicating the element of the computing system to be a target of the requested operation.
14. The system of claim 9 , wherein the signing of the message comprises:
invoking a signing server implemented in the remote management computing domain to generate a signature based on a private key; and
signing the message with the signature.
15. The system of claim 9 , wherein the data storage system:
receives, from the remote management system, the signed message that includes data representative of the requested operation on the storage element and the second token for the remote management system;
verifies that the signed message is from the remote management system;
uses the second token for the remote management system to obtain the local access token from a local token exchange server implemented in the storage system computing domain; and
uses the local access token to access the storage element and perform the requested operation on the storage element.
16. The method of claim 15 , wherein the data storage system using of the local access token to access the storage element comprises:
using the local access token to invoke an application program interface of the data storage system; and
the invoked application program interface of the data storage system executing to perform the requested operation on the storage element.
17. A non-transitory computer-readable medium storing instructions executable by a processor to cause the processor to:
authenticate, at a remote management system implemented in a remote management computing domain, a user requesting access to the remote management system by way of a user computing device, the authenticating including identifying an identifier token for the user;
use the identifier token for the user to obtain, from a token exchange server within the remote management computing domain, the first token for the remote management system;
provide the first token for the remote management system to the user computing device;
receive, at the remote management system and from the user computing device, a request to perform an operation on an element of a computing system implemented in a computing system domain, the request including the first token for the remote management system;
generate, based on the request including the first token for the remote management system, a message that includes data representative of
the requested operation on the element, and
a second token for the remote management system;
sign the message; and
transmit the signed message from the remote management system to the computing system, the signed message configured to be verified and used by the computing system to obtain a local access token configured to be used to access the element and perform the requested operation on the element.
18. The non-transitory computer-readable medium of claim 17 , wherein:
the generating of the message comprises using the first token for the remote management system to obtain, from the token exchange server, the second token for the remote management system; and
the second token for the remote management system comprises data indicating the element of the computing system to be a target of the requested operation.
19. The non-transitory computer-readable medium of claim 17 , wherein the generating of the message comprises:
using the first token for the remote management system to invoke an application program interface, of the remote management system, for remotely accessing the element of the computing system from the remote management system; and
obtaining, by the application program interface from the token exchange server, the second token for the remote management system.
20. The non-transitory computer-readable medium of claim 19 , wherein:
the application program interface is configured for accessing services of the remote management system; and
the services of the remote management system comprise a service for remotely accessing the element of the computing system from the remote management system.