Local controller for local API authorization method and apparatus
Some embodiments provide a local controller on a set of host computers that reduce the volume of data that is communicated between the server set and the set of host computers. The local controller executing on a particular host computer, in some embodiments, receives a portion of the namespace including only the policies (e.g., opcode) that are relevant to API-authorization processing for the applications executing on the particular host computer provided by a local agent executing on the computer to authorize the API requests based on policies and parameters. The local controller analyzes the received policies (e.g., policy opcodes) and identifies the parameters (e.g. operands), or parameter types, needed for API-authorization processing (e.g., evaluating the policy opcode upon receiving a particular API request) by the local agent. In some embodiments, the local controller performs this analysis for each updated set of policies (e.g., policy opcodes).
1. A method for providing policies to a plurality of local API (Application Programming Interface) authorization agents executing on a plurality of computers to use to authorize API calls for processing by applications executing on the plurality of computers, the method comprising:
receiving definitions of a plurality of authorization policies for a set of one or more API calls to the applications executing on the plurality of computers;
storing the plurality of authorization policies; and
distributing different sets of authorization policies to different local controllers executing on the plurality of computers, each particular set of authorization policies distributed to each particular local controller comprising one or more authorization policies relevant for processing API calls to a set of one or more applications executing on a same host computer as the particular local controller, wherein for each application of a set of applications executing on a particular computer, the local controller executing on the particular computer identifies policies applicable to the particular application and provides to a local API authorization agent executing on the particular computer that authorizes API calls for processing by the particular application (i) the policies applicable to the application and (ii) parameter values retrieved from local data sources for use in evaluating the policies.
2. The method of claim 1 , wherein the receiving, storing, and distributing are performed by a set of one or more servers that acts as a logically centralized resource for defining, storing, distributing, and enforcing the policies to authorize the API calls for processing by the applications.
3. The method of claim 1 , wherein the applications executing on the plurality of computers belong to one or more tenants in one or more datacenters.
4. The method of claim 1 , wherein the applications execute as machines on the plurality of computers, the machines comprising one or more of virtual machines (VMs) and containers.
5. The method of claim 1 , wherein the definitions of the plurality of authorization policies are received through a web-based user interface.
6. The method of claim 5 , wherein the plurality of authorization policies comprises policies that are custom defined in terms of different sets of parameters for different sets of applications used in different deployment settings.
7. The method of claim 1 , wherein storing the plurality of authorization policies comprises storing the plurality of authorization policies as a namespace that is a single hierarchical storage structure.
8. The method of claim 7 , wherein the namespace allows each particular authorization policy and a set of parameters associated with the particular authorization policy to be retrieved by providing a location identifier that identifies a location in the namespace.
9. The method of claim 8 , wherein the location stores the set of parameters for the particular authorization policy.
10. The method of claim 8 , wherein the location stores one or more location-identifiers for one or more locations in the namespace at which the set of parameters is previously stored in the namespace.
11. The method of claim 7 , wherein each particular definition for each particular authorization policy is defined by a policy opcode.
12. The method of claim 7 , wherein distributing the different sets of authorization policies to the different local controllers comprises distributing different portions of the namespace to the different local controllers.
13. The method of claim 1 , wherein at least two sets of authorization policies distributed to at least two local controllers comprise at least one overlapping authorization policy.
14. The method of claim 1 , wherein a specific set of authorization policies are distributed to a specific local controller on a specific computer after receiving a query, from a local API authorization agent executing on the specific computer via the specific local controller executing on the specific computer, for policies relevant to the local API authorization agent.
15. The method of claim 1 , wherein the local controller executing on a specific computer retrieves the parameter values for use in evaluating a specific policy from the local data sources by (i) analyzing the specific policy to identify parameters used in evaluating the specific policy and (ii) requesting values for the identified parameters from the local data sources.
16. The method of claim 1 , wherein the local data sources comprise one or more network controllers responsible for controlling resources of a network to which the plurality of computers are connected operate.
17. A system comprising:
a set of one or more servers that receive definitions of a plurality of authorization policies for API (application programming interface) calls to applications and that store the plurality of authorization policies; and
a plurality of computers, each computer executing:
a set of one or more applications that receive and process API calls;
a set of one or more local API authorization agents that authorize API calls to the set of applications according to the authorization policies relevant to the set of applications; and
a set of one or more local controllers that receive authorization policies relevant to the set of applications from the set of one or more servers and, for each application executing on the computer, identify policies applicable to the application and provide to one of the local API authorization agents executing on the particular computer that authorizes API calls for processing by the application, (i) the policies relevant to the application and (ii) parameter values retrieved from local data sources for use in evaluating the policies.
18. The system of claim 17 , wherein the set of local controllers executing on a particular computer provides the policies and parameter values relevant to a particular application to a particular local API authorization agent by populating an API authorization storage that is accessed by the particular local API authorization agent.
19. The system of claim 17 , wherein the policies relevant to a particular application are distributed by the set of one or more servers to a particular local controller in response to a request for the policies from the particular local controller.
20. The system of claim 17 , wherein the local data sources comprise one or more network controllers responsible for controlling resources of a network to which the plurality of computers are connected operate.