MULTITENANT MANAGEMENT SYSTEM AND METHOD
A multitenant management system selects a name space corresponding to a user from a plurality of name spaces and determines whether the user is a legitimate user by using user management information of the name space. When a result of the determination is positive, the system determines whether a resource of an access destination conforming to the received resource access request falls within a resource access range corresponding to one tenant scope indicated by the user management information of the selected name space. When the result of the determination is positive, the system executes the resource access request.
1 . A multitenant management system comprising:
an interface device configured to receive user information that is information regarding a user, tenant information that is information regarding a tenant, and a resource access request for designating a resource of an access destination among a plurality of resources from a user terminal;
a storage device configured to store user management information including information a user regarding associated with a tenant corresponding to a name space for each of a plurality of name spaces including a name space of each tenant; and
a processor connected to the interface device and the storage device, wherein
in each name space, the user management information includes information indicating a tenant scope that is a label of a resource access range for each of one or two or more tenants,
the storage device stores entire scope management information that is information indicating a resource access range corresponding to the tenant scope with regard to each of all tenant scopes, and
the processor
selects a name space corresponding to a tenant indicated by the received tenant information,
executes authentication determination to determine whether the received user information is appropriate for information included in the user management information of the selected name space,
when a result of the authentication determination is positive, executes authorization determination to determine whether a resource of an access destination conforming to the received resource access request falls within a resource access range specified from the entire scope management information to correspond to one tenant scope indicated by the user management information of the selected name space, and
when a result of the authorization determination is positive, executes the received resource access request.
2 . The multitenant management system according to claim 1 , wherein
the plurality of name spaces includes a name space for system management serving as a name space corresponding to an unspecified tenant, and
one or two or more tenant scopes associated with the name space for the system management include a system scope associated with a range of all resources.
3 . The multitenant management system according to claim 2 , wherein
the user management information of the name space for the system management indicates a tenant scope for a tenant corresponding to a name space different from the name space for the system management, and
when the name space for the system management is selected from the received tenant information and a result of the authentication determination is positive using the user management information of the name space for the system management, the processor specifies the tenant scope for the tenant corresponding to the different name space and associated with the name space for the system management based on the resource access request in the authorization determination and specifies resource access range corresponding to the tenant scope from the entire scope management information.
4 . The multitenant management system according to claim 1 , wherein, in each name space, the user management information includes information indicating one or two or more tenant scopes associated with a group for each group of users.
5 . The multitenant management system according to claim 1 , wherein the plurality of resources are resources of a storage system.
6 . The multitenant management system according to claim 1 , wherein
when information regarding a first user of a first tenant and information regarding a second user of a second tenant are included in user management information of a single name space, the processor
creates a name space corresponding to the second tenant, and
transfers the information regarding the second user of the second tenant to the user management information of the created name space.
7 . The multitenant management system according to claim 1 , wherein user management information of a certain name space among the plurality of name spaces includes information regarding one or more users registered in user management information of one or more name spaces different from the certain name space.
8 . The multitenant management system according to claim 7 , wherein
the user management information of the certain name space includes information indicating a name space where the information regarding the user is registered with regard to each of the one or more users, and
the processor
specifies a name space corresponding to a user indicated by the user information from the user management information of the certain name space, and
executes the authentication determination based on the user management information of the specified name space and the user information.
9 . The multitenant management system according to claim 1 , wherein
the storage device stores user affiliation information that is information indicating a name space where a user is registered for each user, and
the processor
specifies a name space corresponding to the user indicated by the user information, and
executes the authentication determination based on the user management information of the specified name space and the user information.
10 . A multitenant management method of causing a computer:
to receive user information that is information regarding a user, tenant information that is information regarding a tenant, and a resource access request for designating a resource of an access destination among a plurality of resources from a user terminal;
to select a name space corresponding to a tenant indicated by the received tenant information; and
to execute authentication determination to determine whether the received user information is appropriate for information included in user management information of the selected name space, wherein
the user management information includes information regarding a user associated with a tenant corresponding to the name space and information indicating a tenant scope that is a label of a resource access range for each of one or two or more tenants for each of a plurality of name spaces including a name space of each tenant,
when a result of the authentication determination is positive, the computer executes authorization determination to determine whether a resource of an access destination conforming to the received resource access request falls within a resource access range specified from entire scope management information to correspond to one tenant scope indicated by the user management information of the selected name space,
the entire scope management information is information indicating a resource access range corresponding to the tenant scope with regard to each of all tenant scopes, and
when a result of the authorization determination is positive, the computer executes the received resource access request.