OAuth2 SAML token service
The present disclosure involves systems, software, and computer implemented methods for principal propagation. One example method includes deploying a token service to a first cloud platform. A first token request is received from an integration component for a token to be included in a message sent from the first cloud platform to a second cloud platform. A user information request is generated and sent to an identity provider associated with the first cloud platform. User information is received from the identity provider in response to the user information request. A second token request is generated and sent to a token service provider associated with the second cloud platform. The second token request includes the received user information. The requested token is received from the token service provider. The received token is sent to the integration component to enable the integration component to send the message to the second cloud platform.
1. A computer-implemented method comprising:
deploying a token service to a first cloud platform, wherein the token service is an OAuth2 SAML token service;
receiving, at the token service, a first token request from an integration component for a token to be included in a message sent by the integration component to a second cloud platform on behalf of a user application associated with a user, wherein the first token request is made using a token request interface provided by the token service; and
in response to receiving the first token request:
generating a user information request to be sent to an identity provider associated with the first cloud platform;
sending the user information request to the identity provider;
receiving user information for the user from the identity provider in response to the user information request;
generating a second token request to be sent to a token service provider associated with the second cloud platform, the second token request including the received user information;
sending the second token request to the token service provider;
receiving a requested token from the token service provider;
sending the received token to the integration component to enable the integration component to send the message to the second cloud platform; and
deploying the token service to a third cloud platform including configuring the token service to invoke a second set of native APIs specific to the second cloud platform, to receive user information provided by the second cloud platform, and to receive token requests from the integration component using the same token request interface.
2. The method of claim 1 , wherein the first token request includes a URL (Uniform Resource Locator) of the token service provider and generating the second token request includes including the URL of the token service provider in the second token request.
3. The method of claim 1 , wherein the user information request is sent using a first set of native APIs (Application Programming Interfaces) specific to the first cloud platform.
4. A system comprising:
one or more computers; and
a computer-readable medium coupled to the one or more computers having instructions stored thereon which, when executed by the one or more computers, cause the one or more computers to perform operations comprising:
deploying a token service to a first cloud platform, wherein the token service is an OAuth2 SAML token service;
receiving, at the token service, a first token request from an integration component for a token to be included in a message sent by the integration component to a second cloud platform on behalf of a user application associated with a user, wherein the first token request is made using a token request interface provided by the token service;
in response to receiving the first token request:
generating a user information request to be sent to an identity provider associated with the first cloud platform;
sending the user information request to the identity provider;
receiving user information for the user from the identity provider in response to the user information request;
generating a second token request to be sent to a token service provider associated with the second cloud platform, the second token request including the received user information;
sending the second token request to the token service provider;
receiving a requested token from the token service provider; and
sending the received token to the integration component to enable the integration component to send the message to the second cloud platform; and
receiving, at the token service, a third token request, using the token request interface, from another integration component that is configured to send messages to a third cloud platform that is a different type of cloud platform than the first cloud platform and the second cloud platform.
5. The system of claim 4 , wherein the first token request includes a URL (Uniform Resource Locator) of the token service provider and generating the second token request includes including the URL of the token service provider in the second token request.
6. The system of claim 4 , wherein the user information request is sent using a first set of native APIs (Application Programming Interfaces) specific to the first cloud platform.
7. The system of claim 4 , wherein the first token request is made using a token request interface provided by the token service.
8. A computer program product encoded on a non-transitory storage medium, the product comprising non-transitory, computer readable instructions for causing one or more processors to perform operations comprising:
deploying a token service to a first cloud platform, wherein the token service is an OAuth2 SAML token service;
receiving, at the token service, a first token request from an integration component for a token to be included in a message sent by the integration component to a second cloud platform on behalf of a user application associated with a user, wherein the first token request is made using a token request interface provided by the token service; and
in response to receiving the first token request:
generating a user information request to be sent to an identity provider associated with the first cloud platform;
sending the user information request to the identity provider;
receiving user information for the user from the identity provider in response to the user information request;
generating a second token request to be sent to a token service provider associated with the second cloud platform, the second token request including the received user information;
sending the second token request to the token service provider;
receiving a requested token from the token service provider;
sending the received token to the integration component to enable the integration component to send the message to the second cloud platform; and
deploying the token service to a third cloud platform including configuring the token service to invoke a second set of native APIs specific to the second cloud platform, to receive user information provided by the second cloud platform, and to receive token requests from the integration component using the same token request interface.
9. The computer program product of claim 8 , wherein the first token request includes a URL (Uniform Resource Locator) of the token service provider and generating the second token request includes including the URL of the token service provider in the second token request.
10. The computer program product of claim 8 , wherein the user information request is sent using a first set of native APIs (Application Programming Interfaces) specific to the first cloud platform.