Multi-path layer configured to provide access authorization for software code of multi-path input-output drivers
An apparatus comprises a processing device configured to receive, from a given multi-path input-output driver of a given one of a plurality of host devices that utilizes a given piece of software for controlling delivery of input-output operations to a storage system over selected ones of a plurality of paths through a network, an access authorization check request for the given piece of software in response to expiration of a designated access authorization refresh interval, wherein authorization to access software code of the given piece of software is provided by an access authorization server external to the plurality of host devices. The processing device is also configured to determine an access authorization status of the given multi-path input-output driver. The processing device is further configured to provide, to the given multi-path input-output driver, an access authorization check response comprising the access authorization status of the given multi-path input-output driver.
1. An apparatus comprising:
at least one processing device comprising a processor coupled to a memory;
the at least one processing device being configured to perform steps of:
receiving, from a given multi-path input-output driver of a given one of a plurality of host devices that utilizes a given piece of software for controlling delivery of input-output operations to a storage system over selected ones of a plurality of paths through a network, an access authorization check request for the given piece of software in response to expiration of a designated access authorization refresh interval, wherein authorization to access software code of the given piece of software is provided by an access authorization server external to the plurality of host devices;
determining, in response to the access authorization check request, an access authorization status of the given multi-path input-output driver, the access authorization status indicating whether the given multi-path input-output driver has a given access authorization credential for the given piece of software checked-out from a pool of two or more access authorization credentials issued by the access authorization server for the plurality of host devices; and
providing, to the given multi-path input-output driver, an access authorization check response comprising the access authorization status of the given multi-path input-output driver, the access authorization status specifying a remaining time on an access authorization linger period for the given access authorization credential.
2. The apparatus of claim 1 wherein the at least one processing device is configured to communicate with the plurality of host devices over a private network not accessible to the access authorization server.
3. The apparatus of claim 1 wherein the access authorization check request and the access authorization check response are communicated utilizing a representational state transfer application programming interface.
4. The apparatus of claim 1 wherein the at least one processing device is further configured to perform the steps of:
responsive to the given multi-path input-output driver having the given access authorization credential for the given piece of software checked-out from the pool of two or more access authorization credentials issued by the access authorization server for the plurality of host devices, determining whether the remaining time on the access authorization linger period for the given access authorization credential is at least a designated threshold length of time less than a length of the designated access authorization refresh interval; and
responsive to determining that the remaining time on the access authorization linger period for the given access authorization credential is at least the designated threshold length of time less than the length of the designated access authorization refresh interval, refreshing the access authorization linger period for the given access authorization credential.
5. The apparatus of claim 1 wherein the at least one processing device is further configured to perform the step of, responsive to the given multi-path input-output driver not having the given access authorization credential for the given piece of software checked-out from the pool of two or more access authorization credentials issued by the access authorization server for the plurality of host devices, determining whether there is an available access authorization credential in the pool of two or more access authorization credentials issued by the access authorization server for the plurality of host devices.
6. The apparatus of claim 5 wherein the at least one processing device is further configured to perform the step of, responsive to determining that there is an available access authorization credential in the pool of two or more access authorization credentials issued by the access authorization server for the plurality of host devices, checking-out the available access authorization credential and registering the available access authorization credential as the given access authorization credential for the given multi-path input-output driver of the given host device, wherein registering the available access authorization credential as the given access authorization credential for the given multi-path input-output driver of the given host device comprises establishing the access authorization linger period for the given access authorization credential.
7. The apparatus of claim 5 wherein the at least one processing device is further configured to perform the step of, responsive to determining that there is not an available access authorization credential in the pool of two or more access authorization credentials issued by the access authorization server for the plurality of host devices, setting the access authorization status of the given multi-path input-output driver of the given host device as unauthorized.
8. The apparatus of claim 1 wherein the access authorization check response comprises an access authorization payload specifying access authorization details for the given access authorization credential, the access authorization details for the given access authorization credential comprising a network address of the at least one processing device to which one or more subsequent access authorization check requests for the given access authorization credential are to be sent following one or more subsequent expirations of the designated access authorization refresh interval.
9. The apparatus of claim 1 wherein providing the access authorization check response further comprises enabling use of the given piece of software by the given multi-path input-output driver of the given host device by persisting a key of the given access authorization credential in at least one of a kernel of the given host device and a process memory of the given host device.
10. The apparatus of claim 1 wherein the at least one processing device comprises a management appliance configured to manage multi-path input-output drivers of the plurality of host devices providing respective production hosts for the given piece of software in an enterprise system.
11. The apparatus of claim 1 wherein the pool of two or more access authorization credentials is issued for the plurality of host devices collectively, such that respective ones of the access authorization credentials in the pool of two or more access authorization credentials are configured to be checked-out for use by a first multi-path input-output driver of a first one of the plurality of host devices for a first period of time and to be checked-out for use by a second multi-path input-output driver of a second one of the plurality of host devices for a second period of time.
12. The apparatus of claim 1 wherein the pool of two or more access authorization credentials is issued independent of hardware configurations of the plurality of host devices, such that respective ones of the access authorization credentials in the pool of two or more access authorization credentials are configured to be checked-out for use by a first multi-path input-output driver of a first one of the plurality of host devices with a first hardware configuration for a first period of time and to be checked-out for use by a second multi-path input-output driver of a second one of the plurality of host devices with a second hardware configuration for a second period of time.
13. The apparatus of claim 1 wherein the pool of two or more access authorization credentials is issued independent of software platform configurations of the plurality of host devices, such that respective ones of the access authorization credentials in the pool of two or more access authorization credentials are configured to be checked-out for use by a first multi-path input-output driver of a first one of the plurality of host devices with a first software platform configuration for a first period of time and to be checked-out for use by a second multi-path input-output driver of a second one of plurality of host devices with a second software platform configuration for a second period of time.
14. The apparatus of claim 1 wherein the at least one processing device is further configured to perform the step of updating the pool of two or more access authorization credentials issued by the access authorization server while maintaining access authorization status of multi-path input-output drivers of ones of the plurality of host devices with checked-out access authorization credentials from the pool of two or more access authorization credentials.
15. A method comprising:
receiving, from a given multi-path input-output driver of a given one of a plurality of host devices that utilizes a given piece of software for controlling delivery of input-output operations to a storage system over selected ones of a plurality of paths through a network, an access authorization check request for the given piece of software in response to expiration of a designated access authorization refresh interval, wherein authorization to access software code of the given piece of software is provided by an access authorization server external to the plurality of host devices;
determining, in response to the access authorization check request, an access authorization status of the given multi-path input-output driver, the access authorization status indicating whether the given multi-path input-output driver has a given access authorization credential for the given piece of software checked-out from a pool of two or more access authorization credentials issued by the access authorization server for the plurality of host devices; and
providing, to the given multi-path input-output driver, an access authorization check response comprising the access authorization status of the given multi-path input-output driver, the access authorization status specifying a remaining time on an access authorization linger period for the given access authorization credential;
wherein the method is performed by at least one processing device comprising a processor coupled to a memory.
16. The method of claim 15 wherein the access authorization check request and the access authorization check response are communicated utilizing a representational state transfer application programming interface.
17. The method of claim 15 further comprising:
responsive to the given multi-path input-output driver having the given access authorization credential for the given piece of software checked-out from the pool of two or more access authorization credentials issued by the access authorization server for the plurality of host devices, determining whether the remaining time on the access authorization linger period for the given access authorization credential is at least a designated threshold length of time less than a length of the designated access authorization refresh interval; and
responsive to determining that the remaining time on the access authorization linger period for the given access authorization credential is at least the designated threshold length of time less than the length of the designated access authorization refresh interval, refreshing the access authorization linger period for the given access authorization credential.
18. A computer program product comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes the at least one processing device to perform steps of:
receiving, from a given multi-path input-output driver of a given one of a plurality of host devices that utilizes a given piece of software for controlling delivery of input-output operations to a storage system over selected ones of a plurality of paths through a network, an access authorization check request for the given piece of software in response to expiration of a designated access authorization refresh interval, wherein authorization to access software code of the given piece of software is provided by an access authorization server external to the plurality of host devices;
determining, in response to the access authorization check request, an access authorization status of the given multi-path input-output driver, the access authorization status indicating whether the given multi-path input-output driver has a given access authorization credential for the given piece of software checked-out from a pool of two or more access authorization credentials issued by the access authorization server for the plurality of host devices; and
providing, to the given multi-path input-output driver, an access authorization check response comprising the access authorization status of the given multi-path input-output driver, the access authorization status specifying a remaining time on an access authorization linger period for the given access authorization credential.
19. The computer program product of claim 18 wherein the access authorization check request and the access authorization check response are communicated utilizing a representational state transfer application programming interface.
20. The computer program product of claim 18 wherein the program code when executed by the first host device further causes the multi-path input-output management station to perform steps of:
responsive to the given multi-path input-output driver having the given access authorization credential for the given piece of software checked-out from the pool of two or more access authorization credentials issued by the access authorization server for the plurality of host devices, determining whether the remaining time on the access authorization linger period for the given access authorization credential is at least a designated threshold length of time less than a length of the designated access authorization refresh interval; and
responsive to determining that the remaining time on the access authorization linger period for the given access authorization credential is at least the designated threshold length of time less than the length of the designated access authorization refresh interval, refreshing the access authorization linger period for the given access authorization credential.