Processing access requests on a service-to-service basis using a third-party identification token
The present disclosure relates to systems, non-transitory computer-readable media, and methods for processing access requests on a service-to-service basis using a third-party identification token. In particular, the disclosed systems can identify that a user is authenticated for a first computer service based on detecting a third-party identification token. Further, the disclosed systems can generate, by the first computer service, an access request comprising a requested action and the third-party identification token to a second computer service. Additionally, the disclosed systems can determine, by the second computer service, whether the access request is authorized based on determining that an authorization policy defined at the second computer service authorizes the requested action by the first computer service and that the third-party identification token is valid. Moreover, the disclosed systems can provide, to the first computer service, a response to the access request in response to determining whether the access request is authorized.
1. A computer-implemented method comprising:
identifying, based on detecting a third-party identification token issued by a third-party authentication service outside a computer system environment, that a user is authenticated for a first computer service within the computer system environment, the computer system environment comprising a microservice environment;
generating, by the first computer service, an access request to a second computer service within the computer system environment, the access request comprising a requested action and the third-party identification token;
determining, by the second computer service, whether the access request is authorized based on determining:
an authorization policy defined at the second computer service authorizes the requested action by the first computer service; and
the third-party identification token is valid; and
providing, by the second computer service to the first computer service, a response to the access request in response to determining whether the access request is authorized.
2. The computer-implemented method of claim 1 , wherein determining, by the second computer service, whether the access request is authorized comprises determining authorization of the access request without determining a permission scope for the user.
3. The computer-implemented method of claim 1 , wherein determining the authorization policy defined at the second computer service authorizes the requested action by the first computer service comprises:
determining that the requested action matches an allowed action within the authorization policy;
determining one or more allowed services for the allowed action; and
determining that the first computer service is one of the one or more allowed services.
4. The computer-implemented method of claim 1 , further comprising:
performing, in response to determining that the access request is authorized, the requested action on the second computer service; and
generating, by the second computer service, the response to the access request.
5. The computer-implemented method of claim 1 , wherein providing the response to the access request to the first computer service comprises providing, in response to determining that the access request is not authorized, a denial response to the first computer service.
6. The computer-implemented method of claim 1 , further comprising:
receiving a user interaction indicating to start test mode; and
determining, while in test mode, one or more prospective denied access requests and one or more prospective allowed access requests.
7. The computer-implemented method of claim 1 , further comprising generating, in response to denying one or more access requests, a decision report comprising one or more reasons for denying the one or more access requests.
8. A non-transitory computer-readable medium storing instructions that, when executed by at least one processor, cause a computing device to:
identify, based on detecting a third-party identification token issued by a third-party authentication service outside a computer system environment, that a user is authenticated for a first computer service within the computer system environment, the computer system environment comprising a microservice environment;
generate, by the first computer service, an access request to a second computer service within the computer system environment, the access request comprising a requested action and the third-party identification token;
determine, by the second computer service, whether the access request is authorized based on determining:
an authorization policy defined at the second computer service authorizes the requested action by the first computer service; and
the third-party identification token is valid; and
provide, by the second computer service to the first computer service, a response to the access request in response to determining whether the access request is authorized.
9. The non-transitory computer-readable medium of claim 8 , wherein determining, by the second computer service, whether the access request is authorized comprises determining authorization of the access request without determining a permission scope for the user.
10. The non-transitory computer-readable medium of claim 8 , wherein determining the authorization policy defined at the second computer service authorizes the requested action by the first computer service comprises:
determining that the requested action matches an allowed action within the authorization policy;
determining one or more allowed services for the allowed action; and
determining that the first computer service is one of the one or more allowed services.
11. The non-transitory computer-readable medium of claim 8 , further comprising instructions that, when executed by the at least one processor, cause the computing device to:
perform, in response to determining that the access request is authorized, the requested action on the second computer service; and
generate, by the second computer service, the response to the access request.
12. The non-transitory computer-readable medium of claim 8 , wherein providing the response to the access request to the first computer service comprises providing, in response to determining that the access request is not authorized, a denial response to the first computer service.
13. The non-transitory computer-readable medium of claim 8 , further comprising instructions that, when executed by the at least one processor, cause the computing device to:
receive, from a user device, a user interaction indicating activation of a test mode; and
determine, while in the test mode, one or more prospective denied access requests and one or more prospective allowed access requests.
14. The non-transitory computer-readable medium of claim 8 , further comprising instructions that, when executed by the at least one processor, cause the computing device to generate, in response to denying one or more access requests, a decision report comprising one or more reasons for denying the one or more access requests, wherein the one or more reasons for denying the one or more access requests comprise determining that the one or more access requests have at least one of a route not found error, a valid token but invalid caller, a missing token, or an invalid token.
15. A system comprising:
at least one processor; and
at least one non-transitory computer-readable storage medium storing instructions that, when executed by the at least one processor, cause the system to:
identify, based on detecting a third-party identification token issued by a third-party authentication service outside a computer system environment, that a user is authenticated for a first computer service within the computer system environment, the computer system environment comprising a microservice environment;
generate, by the first computer service, an access request to a second computer service within the computer system environment, the access request comprising a requested action and the third-party identification token;
determine, by the second computer service, whether the access request is authorized based on determining:
an authorization policy defined at the second computer service authorizes the requested action by the first computer service; and
the third-party identification token is valid; and
provide, by the second computer service to the first computer service, a response to the access request in response to determining whether the access request is authorized.
16. The system of claim 15 , wherein determining, by the second computer service, whether the access request is authorized comprises determining authorization of the access request without determining a permission scope for the user.
17. The system of claim 15 , wherein determining the authorization policy defined at the second computer service authorizes the requested action by the first computer service comprises:
determining that the requested action matches an allowed action within the authorization policy;
determining one or more allowed services for the allowed action; and
determining that the first computer service is one of the one or more allowed services.
18. The system of claim 15 , further comprising instructions that, when executed by the at least one processor, cause the system to:
perform, in response to determining that the access request is authorized, the requested action on the second computer service; and
generate, by the second computer service, the response to the access request.
19. The system of claim 15 , wherein providing the response to the access request to the first computer service comprises providing, in response to determining that the access request is not authorized, a denial response to the first computer service.
20. The system of claim 15 , further comprising instructions that, when executed by the at least one processor, cause the system to:
receive, from a user device, a user interaction indicating activation of a test mode; and
determine, while in the test mode, one or more prospective denied access requests and one or more prospective allowed access requests.