Organizing data in a virtual computing infrastructure
Techniques are provided for authorizations in a virtual computing infrastructure using a federation token service. The techniques may include receiving a request for a launch plan from a user for launching instances in a plurality of sites, determining object permissions required for actions to be performed to launch one or more of the instances at each site of the plurality of sites, contacting an authorization caching service to obtain authorization tokens for each of the determined object permissions required for the actions, receiving the authorization tokens for each of the determined object permissions required for the actions, and forwarding the request to each site of the plurality of sites with an authentication token and the authorization tokens for each of the determined object permissions required for the actions to be performed to launch the one or more of the instances at each site of the plurality of sites.
1. A non-transitory computer-readable storage medium storing instructions which, when executed by one or more processors, cause the one or more processors to:
receive a request for a launch plan from a user for launching instances in a plurality of sites of a distributed computing environment, wherein the request includes an authentication token as proof of authentication of the user;
determine object permissions required for actions to be performed to launch one or more of the instances at each site of the plurality of sites;
contact an authorization caching service to obtain authorization tokens for each of the determined object permissions required for the actions;
receive, from the authorization caching service, the authorization tokens for each of the determined object permissions required for the actions; and
forward the request to each site of the plurality of sites with the authentication token and the authorization tokens for each of the determined object permissions required for the actions to be performed to launch the one or more of the instances at each site of the plurality of sites.
2. The non-transitory computer-readable storage medium of claim 1 , wherein the launch plan specifies a desired set of virtual machines for the instances, at least one image list that the set of virtual machines are to be launched from, and placement relationships that exist between the set of virtual machines.
3. The non-transitory computer-readable storage medium of claim 2 , wherein the at least one image list is a container that provides a mechanism to organize applications, which include machine images that are virtual disk images from which the instances are launched.
4. The non-transitory computer-readable storage medium of claim 2 , wherein the request is received at a federation token service comprising at least one federation end point or federation proxy, and the authorization tokens are obtained on behalf of the user from an identity provider.
5. The non-transitory computer-readable storage medium of claim 2 , wherein each of the object permissions is a delegation of privileges and/or a delegation of authority by an entity with granting authority within the distributed computing environment, and wherein the privileges and/or the authority are an assertion that the user may perform one or more of the actions on one or more objects to launch the one or more of the instances at each site of the plurality of sites.
6. The non-transitory computer-readable storage medium of claim 2 , wherein the request is authorized, when each site of the plurality of sites verifies the authentication token and the authorization tokens using a local authorization service.
7. The non-transitory computer-readable storage medium of claim 6 , wherein the local authorization service for each site of the plurality of sites contains a list of sites and encryption keys that can be used to verify the authentication token and the authorization tokens.
8. A system comprising:
one or more processors; and
a computer-readable storage medium storing instructions that are executable by the one or more processors, wherein the instructions comprise:
receiving a request for a launch plan from a user for launching instances in a plurality of sites of a distributed computing environment, wherein the request includes an authentication token as proof of authentication of the user;
determining object permissions required for actions to be performed to launch one or more of the instances at each site of the plurality of sites;
contacting an authorization caching service to obtain authorization tokens for each of the determined object permissions required for the actions;
receiving, from the authorization caching service, the authorization tokens for each of the determined object permissions required for the actions; and
forwarding the request to each site of the plurality of sites with the authentication token and the authorization tokens for each of the determined object permissions required for the actions to be performed to launch the one or more of the instances at each site of the plurality of sites.
9. The system claim 8 , wherein the launch plan specifies a desired set of virtual machines for the instances, at least one image list that the set of virtual machines are to be launched from, and placement relationships that exist between the set of virtual machines.
10. The system of claim 9 , wherein the at least one image list is a container that provides a mechanism to organize applications, which include machine images that are virtual disk images from which the instances are launched.
11. The system of claim 9 , wherein the request is received at a federation token service comprising at least one federation end point or federation proxy, and the authorization tokens are obtained on behalf of the user from an identity provider.
12. The system of claim 9 , wherein each of the object permissions is a delegation of privileges and/or a delegation of authority by an entity with granting authority within the distributed computing environment, and wherein the privileges and/or the authority are an assertion that the user may perform one or more of the actions on one or more objects to launch the one or more of the instances at each site of the plurality of sites.
13. The system of claim 9 , wherein the request is authorized, when each site of the plurality of sites verifies the authentication token and the authorization tokens using a local authorization service.
14. The system of claim 13 , wherein the local authorization service for each site of the plurality of sites contains a list of sites and encryption keys that can be used to verify the authentication token and the authorization tokens.
15. A method comprising:
receiving, at a federation token service comprising at least one federation end point or federation proxy, a request for a launch plan from a user for launching instances in a plurality of sites of a distributed computing environment, wherein the request includes an authentication token as proof of authentication of the user;
determining, by the at least one federation end point or federation proxy object, permissions required for actions to be performed to launch one or more of the instances at each site of the plurality of sites;
contacting, by the at least one federation end point or federation proxy object, an authorization caching service to obtain authorization tokens for each of the determined object permissions required for the actions, wherein the authorization tokens are obtained on behalf of the user from an identity provider by the authorization caching service;
receiving, at the at least one federation end point or federation proxy object, the authorization tokens for each of the determined object permissions required for the actions from the authorization caching service; and
forwarding, by the at least one federation end point or federation proxy object, the request to each site of the plurality of sites with the authentication token and the authorization tokens for each of the determined object permissions required for the actions to be performed to launch the one or more of the instances at each site of the plurality of sites.
16. The method claim 15 , wherein the launch plan specifies a desired set of virtual machines for the instances, at least one image list that the set of virtual machines are to be launched from, and placement relationships that exist between the set of virtual machines.
17. The method of claim 16 , wherein the at least one image list is a container that provides a mechanism to organize applications, which include machine images that are virtual disk images from which the instances are launched.
18. The method of claim 16 , wherein each of the object permissions is a delegation of privileges and/or a delegation of authority by an entity with granting authority within the distributed computing environment, and wherein the privileges and/or the authority are an assertion that the user may perform one or more of the actions on one or more objects to launch the one or more of the instances at each site of the plurality of sites.
19. The method of claim 16 , wherein the request is authorized, when each site of the plurality of sites verifies the authentication token and the authorization tokens using a local authorization service.
20. The method of claim 19 , wherein the local authorization service for each site of the plurality of sites contains a list of sites and encryption keys that can be used to verify the authentication token and the authorization tokens.