System and method for securely connecting applications to middleware services in a cloud platform
Disclosed herein are systems and methods for secure authentication of a managed application. In one aspect, an exemplary method comprises receiving, by a cloud platform, a request from a managed application to connect to a middleware service, determining that the managed application is authenticated to use the middleware service based on the secret, obtaining a secret associated with the managed application and the middleware service from a secret store, connecting to the middleware service using the secret to establish a secure connection, and delegating, to the managed application, the secure connection between the managed application and the middleware service.
1. A method for secure authentication of a managed application, comprising:
providing, by a cloud platform, the managed application with an identifier for a middleware service;
after providing the identifier, receiving, by the cloud platform, an upload of the managed application;
generating, by the cloud platform, a secret associated with the managed application and the middleware service;
storing the secret in a secret store;
after receiving the upload, receiving, by the cloud platform, a request from the managed application to connect_to the middleware service;
determining that the managed application is authenticated to use the middleware service based on the secret;
obtaining the secret associated with the managed application and the middleware service from the secret store;
connecting to the middleware service using the secret to establish a secure connection; and
delegating, to the managed application, the secure connection between the managed application and the middleware service.
2. The method of claim 1 , wherein the secret is generated based on the managed applications directive to use the middleware service.
3. The method of claim 1 , further comprising:
connecting to the middleware service upon execution of middleware connection call in the managed application.
4. The method of claim 1 , wherein the receiving, connecting and determining are performed in a first process, and the obtaining of the secret and delegating the secure connection are performed using a second process.
5. The method of claim 4 , further comprising:
obtaining a connection handler for handling the secure connection from the second process; and
passing the connection handler to the first process.
6. The method of claim 5 , wherein passing the connection handler is performed by using a file handler passing mechanism of an underlying operating system (OS) executing on a hardware processor.
7. The method of claim 5 , further comprising:
performing obtaining the secret and determining whether the managed application is authenticated in kernel address space of an operating system (OS) executing on the hardware processor, wherein the kernel address space is protected from user address space at a hardware level by the OS.
8. The method of claim 1 , wherein the secret store is one of a key value store or a key management service.
9. A system for secure authentication of a managed application, the system comprising:
a memory; and
at least one processor configured to:
provide the managed application with an identifier for a middleware service;
after providing the identifier, receive an upload of the managed application;
generate a secret associated with the managed application and the middleware service;
store the secret in a secret store;
after receiving the upload, receive, by the cloud platform, a request from the managed application to connect_to the middleware service;
determine that the managed application is authenticated to use the middleware service based on the secret;
obtain the secret associated with the managed application and the middleware service from the secret store;
connect_to the middleware service using the secret to establish a secure connection; and
delegate to the managed application, the secure connection between the managed application and the middleware service.
10. The system of claim 9 , wherein the secret is generated based on the managed applications directive to use the middleware service.
11. The system of claim 9 , the processor further configured to:
connect_to the middleware service upon execution of middleware connection call in the managed application.
12. The system of claim 9 , wherein the receiving, connecting and determining are performed in a first process, and the obtaining of the secret and delegating the secure connection are performed using a second process.
13. The system of claim 12 , wherein the processor is further configured to:
obtain a connection handler for handling the secure connection from the second process; and
pass the connection handler to the first process.
14. The system of claim 13 , wherein passing the connection handler is performed by using a file handler passing mechanism of an underlying operating system (OS) executing on a hardware processor.
15. A non-transitory computer readable medium storing thereon computer executable instructions for secure authentication of a managed application, the instructions including instructions for:
providing, by a cloud platform, the managed application with an identifier for a middleware service;
after providing the identifier, receiving, by the cloud platform, an upload of the managed application;
generating, by the cloud platform, a secret associated with the managed application and the middleware service;
storing the secret in a secret store;
after receiving the upload, receiving, by the cloud platform, a request from the managed application to connect_to the middleware service;
determining that the managed application is authenticated to use the middleware service based on the secret;
obtaining the secret associated with the managed application and the middleware service from the secret store;
connecting to the middleware service using the secret to establish a secure connection; and
delegating, to the managed application, the secure connection between the managed application and the middleware service.
16. The non-transitory computer readable medium of claim 15 , wherein the secret is generated based on the managed applications directive to use the middleware service.
17. The non-transitory computer readable medium of claim 16 , the instructions further comprising instructions for:
connecting to the middleware service upon execution of middleware connection call in the managed application.
18. The non-transitory computer readable medium of claim 15 , wherein the receiving, connecting and determining are performed in a first process, and the obtaining of the secret and delegating the secure connection are performed using a second process.
19. The non-transitory computer readable medium of claim 18 , wherein the instructions further include instructions for:
obtaining a connection handler for handling the secure connection from the second process; and
passing the connection handler to the first process.
20. The non-transitory computer readable medium of claim 19 , wherein passing the connection handler is performed by using a file handler passing mechanism of an underlying operating system (OS) executing on a hardware processor.