Applying overlay network policy based on users

1. A method for managing communication over a network using one or more network computers that include one or more processors that perform actions, comprising:

providing one or more credentials of a user to an authorization service for an underlay network, wherein the authorization service authenticates the user as a member of one or more authorization groups for the underlay network, and wherein the user is associated with a gateway on an overlay network;

providing one or more user groups associated with the overlay network, wherein each user group is associated with one or more access tags, and wherein the one or more user groups for the overlay network are separate from the one or more authorization groups for the underlay network;

providing one or more resource groups associated with one or more resources in the overlay network and one or more resource tags; and

in response to a current time being outside of an access time window associated with the one or more user groups, performing further actions, including:

determining one or more disqualified access tags based on the one or more access tags that are associated with the one or more user groups associated with the access time window;

determining one or more disqualified resource groups based on the one or more resource tags that correspond to the one or more disqualified access tags;

updating policy information for the gateway based on the one or more disqualified resource groups; and

providing the updated policy information to the gateway over the underlay network.

2. The method of claim 1 , further comprising:

comparing the one or more authorization groups with the one or more user groups to generate one or more affirmative first results based on an identifier of each authorization group;

associating the user with each user group that corresponds to each affirmative first result;

comparing the one or more access tags of each user group associated with the user to the one or more resource tags associated with each resource group to generate one or more affirmative second results; and

associating the gateway with each resource group that corresponds to the one or more affirmative second results.

3. The method of claim 1 , further comprising:

generating policy information for the gateway based on each resource group that is associated with the gateway;

providing the policy information to the gateway to define one or more policies associated with the one or more resources in the overlay network; and

in response to a source node associated with the gateway providing overlay traffic directed to a target node in the overlay network, enforcing the one or more policies.

4. The method of claim 1 , further comprising:

employing configuration information provided for the overlay network to enable access by the user to the one or more resources in the overlay network.

5. The method of claim 1 , further comprising:

employing a control channel for the overlay network to provide the policy information to the gateway.

6. The method of claim 1 , further comprising:

providing the one or more credentials of the user to one or more other authorization services, wherein the one or more other authorization services authenticate the user as a member of one or more other authorization groups; and

employing the one or more other authorization groups to determine or modify the one or more resource groups associated with the gateway.

7. The method of claim 1 , further comprising:

employing the gateway to enforce one or more policies for the overlay network, wherein the enforcement includes terminating one or more of connections or traffic tunnels associated with activity that violates at least one policy for the overlay network.

8. A system for managing communication over one or more networks, comprising:

one or more network computers, comprising:

a memory that stores at least instructions; and

one or more processors that execute the instructions to enable performance of actions, including:

providing one or more credentials of a user to an authorization service for an underlay network, wherein the authorization service authenticates the user as a member of one or more authorization groups for the underlay network, and wherein the user is associated with a gateway on an overlay network;

providing one or more user groups associated with the overlay network, wherein each user group is associated with one or more access tags, and wherein the one or more user groups for the overlay network are separate from the one or more authorization groups for the underlay network; and

in response to a current time being outside of an access time window associated with the one or more user groups, performing further actions, including:

determining one or more disqualified access tags based on the one or more access tags that are associated with the one or more user groups associated with the access time window;

determining one or more disqualified resource groups based on the one or more resource tags that correspond to the one or more disqualified access tags;

updating policy information for the gateway based on the one or more disqualified resource groups; and

providing the updated policy information to the gateway over the underlay network; and

one or more client computers, comprising:

a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including:

collecting the one or more credentials from the user.

9. The system of claim 8 , further comprising:

comparing the one or more authorization groups with the one or more user groups to generate one or more affirmative first results based on an identifier of each authorization group;

associating the user with each user group that corresponds to each affirmative first result;

comparing the one or more access tags of each user group associated with the user to the one or more resource tags associated with each resource group to generate one or more affirmative second results; and

associating the gateway with each resource group that corresponds to the one or more affirmative second results.

10. The system of claim 8 , further comprising:

generating policy information for the gateway based on each resource group that is associated with the gateway;

providing the policy information to the gateway to define one or more policies associated with the one or more resources in the overlay network; and

in response to a source node associated with the gateway providing overlay traffic directed to a target node in the overlay network, enforcing the one or more policies.

11. The system of claim 8 , further comprising:

employing configuration information provided for the overlay network to enable access by the user to the one or more resources in the overlay network.

12. The system of claim 8 , further comprising:

employing a control channel for the overlay network to provide the policy information to the gateway.

13. The system of claim 8 , further comprising:

providing the one or more credentials of the user to one or more other authorization services, wherein the one or more other authorization services authenticate the user as a member of one or more other authorization groups; and

employing the one or more other authorization groups to determine or modify the one or more resource groups associated with the gateway.

14. The system of claim 8 , further comprising:

employing the gateway to enforce one or more policies for the overlay network, wherein the enforcement includes terminating one or more of connections or traffic tunnels associated with activity that violates at least one policy for the overlay network.

15. A processor readable non-transitory storage media that includes instructions for managing communication over one or more networks, wherein execution of the instructions by the one or more network computers enables performance of a method comprising:

providing one or more credentials of a user to an authorization service for an underlay network, wherein the authorization service authenticates the user as a member of one or more authorization groups for the underlay network, and wherein the user is associated with a gateway on an overlay network;

providing one or more user groups associated with the overlay network, wherein each user group is associated with one or more access tags, and wherein the one or more user groups for the overlay network are separate from the one or more authorization groups for the underlay network; and

in response to a current time being outside of an access time window associated with the one or more user groups, performing further actions, including:

determining one or more disqualified access tags based on the one or more access tags that are associated with the one or more user groups associated with the access time window;

determining one or more disqualified resource groups based on the one or more resource tags that correspond to the one or more disqualified access tags;

updating policy information for the gateway based on the one or more disqualified resource groups; and

providing the updated policy information to the gateway over the underlay network.

16. The processor readable non-transitory storage media of claim 15 , further comprising:

comparing the one or more authorization groups with the one or more user groups to generate one or more affirmative first results based on an identifier of each authorization group;

associating the user with each user group that corresponds to each affirmative first result;

comparing the one or more access tags of each user group associated with the user to the one or more resource tags associated with each resource group to generate one or more affirmative second results; and

associating the gateway with each resource group that corresponds to the one or more affirmative second results.

17. The processor readable non-transitory storage media of claim 15 , further comprising:

generating policy information for the gateway based on each resource group that is associated with the gateway;

providing the policy information to the gateway to define one or more policies associated with the one or more resources in the overlay network; and

in response to a source node associated with the gateway providing overlay traffic directed to a target node in the overlay network, enforcing the one or more policies.

18. The processor readable non-transitory storage media of claim 15 , further comprising:

employing configuration information provided for the overlay network to enable access by the user to the one or more resources in the overlay network.

19. The processor readable non-transitory storage media of claim 15 , further comprising:

employing a control channel for the overlay network to provide the policy information to the gateway.

20. The processor readable non-transitory storage media of claim 15 , further comprising:

employing the gateway to enforce one or more policies for the overlay network, wherein the enforcement includes terminating one or more of connections or traffic tunnels associated with activity that violates at least one policy for the overlay network.