Granted Patent B2

US 12,363,120 · App. 17/497,623 · Granted Jul 15, 2025

Inventors: Onkar Bhat (San Jose, CA); Deepika Dixit (Santa Clara, CA); Vaibhav Kamra (Sunnyvale, CA); Thomas Manville (Mountain View, CA)

Assignee: Kasten, Inc.

H04L63/102H04L63/101H04L63/104

Abstract

Claims (87)

1. A computer-implemented method for role-based access control in multi-tenant environments, comprising:

executing an application in a cluster;

creating a role object for the cluster, wherein the role object comprises a set of permissions for one or more namespaces in the cluster;

creating a role binding object storing a mapping between a user and the set of permissions for the one or more namespaces in the cluster, wherein the role binding object is persistently stored and managed as a cloud-native object in a cloud-orchestrator, the role binding object specifies a binding of the user to the role object, and the role binding object designates that the user only has access to the one or more namespaces in the cluster;

binding the role object to the role binding object to create an updated role object containing role references and subjects;

receiving login credentials from the user;

transmitting a request to an authentication service to authenticate the user based on the login credentials;

receiving a list of permissions for the user corresponding to the set of permissions associated with the updated role object; and

causing a display of one or more system assets on a user interface of a client device based on the list of permissions for the user.

2. The computer-implemented method of claim 1 , further comprising:

receiving a token corresponding to the user; and

mapping the token corresponding to the user to an application access list, wherein the application access list comprises one or more applications to which the user has access.

3. The computer-implemented method of claim 2 , further comprising:

causing the display of the one or more system assets on the user interface of the client device based on the application access list.

4. The computer-implemented method of claim 1 , further comprising:

receiving, from the user, a request to perform a plurality of operations in the application;

submitting, to the cloud orchestrator, a request to determine whether the user has authorization to perform the plurality of operations in the application based on the list of permissions for the user;

receiving, from the cloud orchestrator, results that the user is authorized to perform the plurality of operations in the application; and

authorizing the user to perform the plurality of operations in the application based on the results.

5. The computer-implemented method of claim 1 , further comprising:

receiving, from the user, a request to perform a plurality of operations in the application;

submitting, to the cloud orchestrator, a request to determine whether the user has authorization to perform the plurality of operations in the application based on the list of permissions for the user;

receiving, from the cloud orchestrator, results that the user is unauthorized to perform the plurality of operations in the application; and

causing a display of an error message on the user interface of the client device based on the results.

6. The computer-implemented method of claim 1 , further comprising:

creating a second role object for the cluster, wherein the second role object comprises a second set of permissions for each namespace in the cluster; and

creating a cluster role binding object based on a group of users and the second set of permissions, wherein the cluster role binding object specifies a binding of the group of users to the second role object, and the cluster role binding object designates that the group of users can perform one or more operations in each of the namespaces in the cluster.

7. The computer-implemented method of claim 1 , further comprising:

creating a second role object for the cluster, wherein the second role object comprises a second set of permissions for one or more namespaces in the cluster; and

creating a second role binding object based on a group of users and the second set of permissions, wherein the second role binding object specifies a binding of the group of users to the second role object, and the second role binding object designates that the group of users only has access to the one or more namespaces in the cluster.

8. A system for role-based access control in multi-tenant environments, comprising:

a memory; and

at least one processor coupled to the memory and configured to:

execute an application in a cluster;

create a role object for the cluster, wherein the role object comprises a set of permissions for one or more namespaces in the cluster;

create a role binding object storing a mapping between a user and the set of permissions for the one or more namespaces in the cluster, wherein the role binding object is persistently stored and managed as a cloud-native object in a cloud-orchestrator, the role binding object specifies a binding of the user to the role object, and the role binding object designates that the user only has access to the one or more namespaces in the cluster;

bind the role object to the role binding object to create an updated role object containing role references and subjects;

receive login credentials from the user;

transmit a request to an authentication service to authenticate the user based on the login credentials;

receiving a list of permissions for the user corresponding to the set of permissions associated with the updated role object; and

cause a display of one or more system assets on a user interface of a client device based on the list of permissions for the user.

9. The system of claim 8 , wherein the at least one processor is configured to:

receive a token corresponding to the user; and

map the token corresponding to the user to an application access list, wherein the application access list comprises one or more applications to which the user has access.

10. The system of claim 9 , wherein the at least one processor is configured to:

cause the display of the one or more system assets on the user interface of the client device based on the application access list.

11. The system of claim 8 , wherein the at least one processor is configured to:

receive, from the user, a request to perform a plurality of operations in the application;

submit, to the cloud orchestrator, a request to determine whether the user has authorization to perform the plurality of operations in the application based on the list of permissions for the user;

receive, from the cloud orchestrator, results that the user is authorized to perform the plurality of operations in the application; and

authorize the user to perform the plurality of operations in the application based on the results.

12. The system of claim 8 , wherein the at least one processor is configured to:

receive, from the user, a request to perform a plurality of operations in the application;

submit, to the cloud orchestrator, a request to determine whether the user has authorization to perform the plurality of operations in the application based on the list of permissions for the user;

receive, from the cloud orchestrator, results that the user is unauthorized to perform the plurality of operations in the application; and

cause a display of an error message on the user interface of the client device based on the results.

13. The system of claim 8 , wherein the at least one processor is configured to:

create a second role object for the cluster, wherein the second role object comprises a second set of permissions for each namespace in the cluster; and

create a cluster role binding object based on a group of users and the second set of permissions, wherein the cluster role binding object specifies a binding of the group of users to the second role object, and the cluster role binding object designates that the group of users can perform one or more operations in each of the namespaces in the cluster.

14. The system of claim 8 , wherein the at least one processor is configured to:

create a second role object for the cluster, wherein the second role object comprises a second set of permissions for one or more namespaces in the cluster; and

create a second role binding object based on a group of users and the second set of permissions, wherein the second role binding object specifies a binding of the group of users to the second role object, and the second role binding object designates that the group of users only has access to the one or more namespaces in the cluster.

15. A non-transitory computer-readable medium for role-based access control in multi-tenant environments having instructions stored thereon that, when executed by at least one computing device, cause the at least one computing device to perform operations comprising:

executing an application in a cluster;

creating a role object for the cluster, wherein the role object comprises a set of permissions for one or more namespaces in the cluster;

creating a role binding object storing a mapping between a user and the set of permissions for the one or more namespaces in the cluster, wherein the role binding object is persistently stored and managed as a cloud-native object in a cloud-orchestrator, the role binding object specifies a binding of the user to the role object, and the role binding object designates that the user only has access to the one or more namespaces in the cluster;

binding the role object to the role binding object to create an updated role object containing role references and subjects;

receiving login credentials from the user;

transmitting a request to an authentication service to authenticate the user based on the login credentials;

receiving a list of permissions for the user corresponding to the set of permissions associated with the updated role object; and

causing a display of one or more system assets on a user interface of a client device based on the list of permissions for the user.

16. The non-transitory computer-readable medium of claim 15 , the operations further comprising:

receiving a token corresponding to the user; and

mapping the token corresponding to the user to an application access list, wherein the application access list comprises one or more applications to which the user has access.

17. The non-transitory computer-readable medium of claim 16 , the operations further comprising:

causing the display of the one or more system assets on the user interface of the client device based on the application access list.

18. The non-transitory computer-readable medium of claim 15 , the operations further comprising:

receiving, from the user, a request to perform a plurality of operations in the application;

submitting, to the cloud orchestrator, a request to determine whether the user has authorization to perform the plurality of operations in the application based on the list of permissions for the user;

receiving, from the cloud orchestrator, results that the user is authorized to perform the plurality of operations in the application; and

authorizing the user to perform the plurality of operations in the application based on the results.

19. The non-transitory computer-readable medium of claim 15 , the operations further comprising:

creating a second role object for the cluster, wherein the second role object comprises a second set of permissions for each namespace in the cluster; and

creating a cluster role binding object based on a group of users and the second set of permissions, wherein the cluster role binding object specifies a binding of the group of users to the second role object, and the cluster role binding object designates that the group of users can perform one or more operations in each the namespaces in the cluster.

20. The non-transitory computer-readable medium of claim 15 , the operations further comprising:

creating a second role object for the cluster, wherein the second role object comprises a second set of permissions for one or more namespaces in the cluster; and

creating a second role binding object based on a group of users and the second set of permissions, wherein the second role binding object specifies a binding of the group of users to the second role object, and the second role binding object designates that the group of users only has access to the one or more namespaces in the cluster.

Assignments (2)

Continuity (1)

References Cited (19)