Authenticating communication

1. A method, comprising:

generating, by a computer system, cryptographic information usable for authenticating communications between first and second multi-tenant applications, wherein the cryptographic information includes:

a master private key usable to derive, based on tenant identifiers, tenant-specific private keys for a plurality of tenants hosted by the first multi-tenant application; and

master public information usable to derive, based on the tenant identifiers, tenant-specific public keys for the plurality of tenants;

sending, by the computer system, the master public information to a directory service accessible to the second multi-tenant application, wherein the second multi-tenant application is operable to use the master public information to derive, without the second multi-tenant application maintaining public keys for each of the plurality of tenants, tenant-specific public keys that can be used to authenticate communications from the first multi-tenant application;

receiving, from the first multi-tenant application by the computer system, a key request for a tenant-specific private key for a tenant of the plurality of tenants that is useable to sign a request to the second multi-tenant application on behalf of the tenant, wherein the key request and the request to the second multi-tenant application include a tenant identifier that identifies the tenant;

performing, by the computer system, a key derivation function to generate a particular tenant-specific private key for the tenant based on the master private key and the tenant identifier; and

sending, by the computer system, the particular tenant-specific private key to the first multi-tenant application.

2. The method of claim 1 , further comprising:

receiving, from the first multi-tenant application by the computer system, a subsequent key request for a tenant-specific private key for a different tenant of the plurality of tenants, wherein the subsequent key request includes an identifier of the different tenant; and

performing, by the computer system, the key derivation function to generate a different particular tenant-specific private key for the different tenant based on the master private key and the identifier of the different tenant.

3. The method of claim 1 , further comprising:

accessing, by the computer system, certificate information indicating that the computer system is authorized to generate cryptographic information for the plurality of tenants hosted by the first multi-tenant application.

4. The method of claim 3 , wherein sending the master public information to the directory service includes:

sending, to the directory service by the computer system, the certificate information to enable registration of the master public information at the directory service on behalf of the first multi-tenant application.

5. The method of claim 3 , further comprising:

receiving, by the computer system, a subsequent key request for a tenant-specific private key for a particular tenant not indicated by the certificate information; and

rejecting, by the computer system, the subsequent key request.

6. The method of claim 3 , further comprising:

performing, by the computer system, a refresh operation that replaces the master private key and the master public information with a new master private key and new master public information, respectively.

7. The method of claim 6 , wherein the refresh operation is performed in response to the certificated information being modified.

8. The method of claim 1 , wherein the first multi-tenant application is operable to sign the request to a second multi-tenant application using the particular tenant-specific private key, and wherein the request to the second multi-tenant application includes information identifying the master public information at the directory service.

9. The method of claim 1 , wherein the first multi-tenant application is a cloud-based service that is operable to store data for the plurality of tenants, and wherein the tenant identifier of the tenant further identifies the cloud-based service.

10. The method of claim 1 , wherein the generating of the cryptographic information is performed by a cryptographic information generator executing on the computer system, wherein the cryptographic information generator and the first multi-tenant application are deployed on a virtual cluster.

11. The method of claim 10 , wherein the cryptographic information generator is accessible only by entities of the virtual cluster.

12. The method of claim 1 , wherein the first and second multi-tenant applications are part of the same multi-tenant system.

13. A non-transitory computer readable medium having program instructions stored thereon that are capable of causing a computer system to perform operations comprising:

generating cryptographic information usable to authenticate communications between first and second multi-tenant applications, wherein the cryptographic information includes:

a master private key usable to derive, based on tenant identifiers, tenant-specific private keys for a plurality of tenants hosted by the first multi-tenant application; and

public key parameters usable to derive, based on the tenant identifiers, tenant-specific public keys for the plurality of tenants;

sending the public key parameters to a directory service accessible to the second multi-tenant application for retrieving the public key parameters, wherein the second multi-tenant application is operable to use the public key parameters to derive, without the second multi-tenant application maintaining public keys for each of the plurality of tenants, tenant-specific public keys that can be used to authenticate communications from the first multi-tenant application;

receiving, from the first multi-tenant application, a key request for a tenant-specific private key specific to a tenant of the plurality of tenants that is useable to sign a request to the second multi-tenant application on behalf of the tenant, wherein the key request and the request to the second multi-tenant application include a tenant identifier that identifies the tenant;

performing a key derivation function to generate a particular tenant-specific private key specific to the tenant based on the master private key and the tenant identifier; and

sending, to the first multi-tenant application, the particular tenant-specific private key.

14. The medium of claim 10 , wherein the operations further comprise:

receiving, from the first multi-tenant application, another key request for a tenant-specific private key specific to a different tenant of the plurality of tenants, wherein the other key request includes an identifier that is associated with the different tenant;

performing the key derivation function to generate a different tenant-specific private key specific to the different tenant based on the master private key and the identifier associated with the different tenant; and

sending, to the first multi-tenant application, the different tenant-specific private key.

15. The medium of claim 10 , wherein sending the public key parameters to the directory service includes:

sending, to the directory service, certification information indicating that the computer system is authorized to register the public key parameters at the directory service in association with the first multi-tenant application.

16. A method, comprising:

receiving, by a first multi-tenant application executing on a first computer system, an operation request signed by a second multi-tenant application executing on a second computer system, wherein the operation request specifies a set of operations to be performed on behalf of a tenant of a plurality of tenants of the second computer system, and wherein the operation request includes a tenant identifier that identifies the tenant and a reference to master public information stored by a directory service, and wherein master public information is usable by the first multi-tenant application to derive, without the first multi-tenant application maintaining public keys for each of the plurality of tenants, tenant-specific public keys that can be used to authenticate communications from the second multi-tenant application;

retrieving, by the first multi-tenant application, the master public information from the directory service using the reference;

performing, by the first multi-tenant application, a key derivation function to generate a tenant-specific public key specific to the tenant based on the master public information and the tenant identifier specified in the operation request; and

verifying, by the first multi-tenant application, that the operation request was signed on behalf of the tenant based on the generated tenant-specific public key.

17. The method of claim 16 , further comprising:

sending, to a third computer system by the first computer system, a particular operation request to perform a set of operations on behalf of a second tenant of the first computer system, wherein sending the particular operation request includes:

sending a key request to a private key generator for a tenant-specific private key that is specific to the second tenant, wherein the key request includes a second tenant identifier that identifies the second tenant;

receiving a particular tenant-specific private key from the private key generator; and

signing the particular operation request based on the particular tenant-specific private key.

18. The method of claim 17 , wherein the second tenant identifier further indicates the second computer system.

19. The method of claim 16 , further comprising:

in response to determining that a signature of the operation request is invalid, the first multi-tenant application rejecting the operation request from the second multi-tenant application.

20. The method of claim 16 , wherein the first and second computer systems are a part of a multi-user system that hosts the plurality of tenants, and wherein the first and second computer systems each implement a respective service for ones of the plurality of tenants.