Applying overlay network policy based on users
Embodiments are directed to managing communication. Credentials of a user may be provided to an authorization service such that the authorization service authenticates the user as a member of authorization groups and such that the user may be associated with a gateway on an overlay network. The authorization groups may be compared with user groups to associate the user with one or more user group. The gateway may be associated with one or more resource group based on the user groups. Policy information may be generated for the gateway based on each resource group. The policy information may be provided to the gateway to define policies associated with resources in the overlay network. The policy information may be enforced against source nodes providing overlay traffic directed to target nodes in the overlay network.
1. A method, comprising:
providing credentials of users to an authorization service for an underlay network, wherein the authorization service authenticates the users as members of one or more authorization groups for the underlay network;
providing one or more user groups associated with an overlay network, each user being associated with a respective user group of the one or more user groups, the user group for a respective user identified based on a match of the user group to an authorization group in which the respective user is authenticated as a member;
providing one or more resource groups associated with one or more resources in the overlay network; and
configuring policy information for gateways of the overlay network according to an access time window, wherein the policy information is configured according to one or more disqualified access tags and one or more disqualified resource groups,
the one or more disqualified access tags being determined according to at least some of the one or more user groups associated with the access time window, and
the one or more disqualified resource groups determined based on resources corresponding to the one or more disqualified access tags.
2. The method of claim 1 , further comprising providing the policy information to the gateway over the underlay network.
3. The method of claim 2 , wherein the policy information is configured and provided to the gateway, responsive to a current time being outside of the access time window.
4. The method of claim 1 , wherein each user group is associated with one or more access tags, and each resource group is associated with one or more resource tags, and wherein the one or more disqualified access tags are determined based on the one or more access tags of respective user groups associated with the access time window.
5. The method of claim 4 , wherein the one or more access tags of the respective user groups associated with the access time window are identified, based on the respective user groups having disqualified access to the resources corresponding to the disqualified access tags within the access time window.
6. The method of claim 1 , further comprising:
providing the policy information to the gateway to define one or more policies associated with the one or more resources in the overlay network, the gateway enforcing the one or more policies in response to a source node associated with the gateway providing overlay traffic directed to a target node in the overlay network.
7. The method of claim 1 , wherein the policy information is configured for respective gateways based on which resource groups are associated with the respective gateway.
8. The method of claim 1 , further comprising:
providing one or more credentials of a user to one or more other authorization services, wherein the one or more other authorization services authenticate the user as a member of one or more other authorization groups; and
updating the one or more resource groups associated with the gateway according to the one or more other authorization groups.
9. The method of claim 1 , wherein the gateway enforces one or more policies for the overlay network according to the policy information, the gateway enforcing the one or more policies by terminating one or more of connections or traffic tunnels associated with activity that violates at least one policy of the one or more policies.
10. A system, comprising:
one or more network computers comprising memory storing instructions and one or more processors configured to execute the instructions to cause the one or more network computers to:
provide credentials of users to an authorization service for an underlay network, wherein the authorization service authenticates the users as members of one or more authorization groups for the underlay network;
provide one or more user groups associated with an overlay network, each user being associated with a respective user group of the one or more user groups, the user group for a respective user identified based on a match of the user group to an authorization group in which the respective user is authenticated as a member;
provide one or more resource groups associated with one or more resources in the overlay network; and
configure policy information for gateways of the overlay network according to an access time window, wherein the policy information is configured according to one or more disqualified access tags and one or more disqualified resource groups,
the one or more disqualified access tags being determined according to at least some of the one or more user groups associated with the access time window, and
the one or more disqualified resource groups determined based on resources corresponding to the one or more disqualified access tags.
11. The system of claim 10 , wherein the one or more processors are further configured to execute the instruction to cause the one or more network computers to provide the policy information to the gateway over the underlay network.
12. The system of claim 11 , wherein the policy information is configured and provided to the gateway, responsive to a current time being outside of the access time window.
13. The system of claim 10 , wherein each user group is associated with one or more access tags, and each resource group is associated with one or more resource tags, and wherein the one or more disqualified access tags are determined based on the one or more access tags of respective user groups associated with the access time window.
14. The system of claim 13 , wherein the one or more access tags of the respective user groups associated with the access time window are identified, based on the respective user groups having disqualified access to the resources corresponding to the disqualified access tags within the access time window.
15. The system of claim 10 , wherein the one or more processors are further configured to execute the instruction to cause the one or more network computers to:
provide the policy information to the gateway to define one or more policies associated with the one or more resources in the overlay network, the gateway enforcing the one or more policies in response to a source node associated with the gateway providing overlay traffic directed to a target node in the overlay network.
16. The system of claim 10 , wherein the policy information is configured for respective gateways based on which resource groups are associated with the respective gateway.
17. The system of claim 10 , wherein the one or more processors are further configured to execute the instruction to cause the one or more network computers to:
provide one or more credentials of a user to one or more other authorization services, wherein the one or more other authorization services authenticate the user as a member of one or more other authorization groups; and
update the one or more resource groups associated with the gateway according to the one or more other authorization groups.
18. The system of claim 10 , further comprising the gateways.
19. The system of claim 18 , wherein the gateway enforces one or more policies for the overlay network according to the policy information, the gateway enforcing the one or more policies by terminating one or more of connections or traffic tunnels associated with activity that violates at least one policy of the one or more policies.
20. A non-transitory computer-readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to:
provide credentials of users to an authorization service for an underlay network, wherein the authorization service authenticates the users as members of one or more authorization groups for the underlay network;
provide one or more user groups associated with an overlay network, each user being associated with a respective user group of the one or more user groups, the user group for a respective user identified based on a match of the user group to an authorization group in which the respective user is authenticated as a member;
provide one or more resource groups associated with one or more resources in the overlay network; and
configure policy information for gateways of the overlay network according to an access time window, wherein the policy information is configured according to one or more disqualified access tags and one or more disqualified resource groups,
the one or more disqualified access tags being determined according to at least some of the one or more user groups associated with the access time window, and
the one or more disqualified resource groups determined based on resources corresponding to the one or more disqualified access tags.