Bridging authorization standard for cloud storage
A computer-implemented method includes receiving, from a user account, an operation request to perform an operation on data stored at a distributed computing environment. The operation request includes an on-premises token associated with the user account. The method also includes extracting, from the on-premises token, an access scope associated with permissions of the user account for accessing the data stored at the distributed computing environment. The method also includes translating the extracted access scope into query parameters compatible with the data stored at the distributed computing environment. The method also includes determining, using the query parameters, whether the operation request can access the data stored at the distributed computing environment. When the operation request can access the data stored at the distributed computing environment, the method includes executing the operation request.
1. A computer-implemented method when executed on data processing hardware causes the data processing hardware to perform operations comprising:
receiving, from a user account, an operation request to perform an operation on data stored at a distributed computing environment, the operation request comprising an on-premises token associated with the user account;
extracting, from the on-premises token, an access scope associated with permissions of the user account for accessing the data stored at the distributed computing environment;
translating the extracted access scope into query parameters compatible with the data stored at the distributed computing environment;
determining, using the query parameters, whether the operation request is authorized to access the data stored at the distributed computing environment; and
when the operation request is authorized to access the data stored at the distributed computing environment using the query parameters, executing the operation request.
2. The computer-implemented method of claim 1 , wherein an on-premises computing system:
receives a login request from the user account; and
generates the on-premises token associated with the user account.
3. The computer-implemented method of claim 2 , wherein the operations further comprise validating that the on-premises computing system is trusted.
4. The computer-implemented method of claim 1 , wherein the operations further comprise generating, based on the on-premises token, an off-premises token associated with permissions for one or more downstream computing operations in the distributed computing environment.
5. The computer-implemented method of claim 1 , wherein the operations further comprise:
sending, to an on-premises computing system, an access scope request requesting additional access scope of the user account; and
receiving, from the on-premises computing system, the additional access scope of the user account.
6. The computer-implemented method of claim 1 , wherein the operations further comprise:
extracting, from the on-premises token, a user context indicating a patient identifier;
translating the extracted user context into additional query parameters compatible with the data stored at the distributed computing environment;
determining, using the additional query parameters, whether the operation request is authorized to access the data stored at the distributed computing environment; and
when the operation request is authorized to access the data stored at the distributed computing environment using the additional query parameters, executing the operation request.
7. The computer-implemented method of claim 1 , wherein the query parameters comprise a Hypertext Transfer Protocol (HTTP) header.
8. The computer-implemented method of claim 1 , wherein the operation request further comprises an operation type associated with the operation and a data identifier associated with the data.
9. The computer-implemented method of claim 1 , wherein the operations further comprise modifying the operation request based on the query parameters.
10. The computer-implemented method of claim 1 , wherein the access scope comprises at least one of:
a user account class;
a data type; or
an operation type.
11. A system comprising:
data processing hardware; and
memory hardware in communication with the data processing hardware, the memory hardware storing instructions that when executed on the data processing hardware cause the data processing hardware to perform operations comprising:
receiving, from a user account, an operation request to perform an operation on data stored at a distributed computing environment, the operation request comprising an on-premises token associated with the user account;
extracting, from the on-premises token, an access scope associated with permissions of the user account for accessing the data stored at the distributed computing environment;
translating the extracted access scope into query parameters compatible with the data stored at the distributed computing environment;
determining, using the query parameters, whether the operation request is authorized to access the data stored at the distributed computing environment; and
when the operation request is authorized to access the data stored at the distributed computing environment using the query parameters, executing the operation request.
12. The system of claim 11 , wherein an on-premises computing system:
receives a login request from the user account; and
generates the on-premises token associated with the user account.
13. The system of claim 12 , wherein the operations further comprise validating that the on-premises computing system is trusted.
14. The system of claim 11 , wherein the operations further comprise generating, based on the on-premises token, an off-premises token associated with permissions for downstream computing operations in the distributed computing environment.
15. The system of claim 11 , wherein the operations further comprise:
sending, to an on-premises computing system, an access scope request requesting additional access scope of the user account; and
receiving, from the on-premises computing system, the additional access scope of the user account.
16. The system of claim 11 , wherein the operations further comprise:
extracting, from the on-premises token, a user context indicating a patient identifier;
translating the extracted user context into additional query parameters compatible with the data stored at the distributed computing environment;
determining, using the additional query parameters, whether the operation request is authorized to access the data stored at the distributed computing environment; and
when the operation request is authorized to access the data stored at the distributed computing environment using the additional query parameters, executing the operation request.
17. The system of claim 11 , wherein the query parameters comprise a Hypertext Transfer Protocol (HTTP) header.
18. The system of claim 11 , wherein the operation request further comprises an operation type associated with the operation and a data identifier associated with the data.
19. The system of claim 11 , wherein the operations further comprise modifying the operation request based on the query parameters.
20. The system of claim 11 , wherein the access scope comprises at least one of:
a user account class;
a data type; or
an operation type.