Secure resource authorization for external identities using remote principal objects
Methods of secure resource authorization for external identities using remote principal objects are performed by systems and devices. An external entity creates a user group and defines entitlements to an owning entity's secure resource as a set of permissions for the group. An immutable access template with the permissions and an access policy for the secure resource are provided to the owning entity for approval. On approval, a remote principal object is created in the owner directory according to the permissions and access policy. A remote principal that is a group member requests access via an interface to the owner domain using external domain credentials. The identity of the remote principal is verified against the remote principal object by a token service. Verification causes generation and issuance of a token, with the enumerated entitlements, to the remote principal interface affecting a redirect for access to the secure resource.
1. A system for authorizing access by a remote principal of a second domain to a secure data resource in a first domain, the system comprising:
a processing system that includes one or more processors; and
at least one memory that stores program code to be executed by the processing system to perform a method, the method comprising:
generating a data structure that specifies a group, at and associated with the second domain, that is based on an access requirement to the secure data resource in the first domain of a domain host, the first domain being different from the second domain;
retrieving a permissions template generated at the second domain, the permissions template defining a set of permissions that include at least one entitlement for members of the group to the secure data resource;
generating an access policy of the secure data resource that is associated with the set of permissions;
providing the set of permissions and the access policy to the domain host for the first domain, the set of permissions and the access policy being immutable from the first domain; and
providing to the first domain on behalf of the remote principal, as a member of the group, an access permission approval request for the secure data resource causing generation in a directory of the first domain at the domain host of a remote principal object based at least on an indication of an approval of the access permission approval request from the first domain, the remote principal object linking the group to the at least one entitlement for the secure data resource as enumerated in the set of permissions and specified by the access policy.
2. The system of claim 1 , wherein the method comprises:
receiving a subsequent access permission approval request from the remote principal or another member of the group subsequent to said providing to the first domain on behalf of the remote principal the access permission approval request;
determining at least one of:
the approval remaining valid, or
the remote principal object remaining valid in the directory; and
notifying the remote principal or the other member of the group of an effective approval for the subsequent access permission approval request.
3. The system of claim 1 , wherein the method comprises:
receiving a request from the remote principal for addition to the group;
verifying credentials of the remote principal against a group access policy that is specific to the group and that is stored at the second domain; and
adding the remote principal to the group by storing remote principal information in the data structure.
4. The system of claim 1 , wherein the method comprises:
receiving the indication of the approval of the access permission approval request; and
providing a notification of the approval to the remote principal in the second domain.
5. The system of claim 1 , wherein the access policy specifies a temporal validity period for the remote principal object; and
wherein the method comprises:
causing a removal of the remote principal object, the set of permissions, and the access policy at the domain host for the first domain based on at least one of:
receiving an access permission revocation from the first domain, or
an expiration of the temporal validity period.
6. The system of claim 1 , wherein the method comprises:
prior to said generating the data structure, receiving a task request from the first domain, wherein the access requirement to the secure data resource is associated with the task request and a task of the task request includes an operation required on the secure data resource; and
causing a removal of the set of permissions and the access policy at the domain host for the first domain based on a completion indication for the task.
7. The system of claim 1 , wherein the method comprises:
prior to said generating the data structure, receiving a task request from the first domain, wherein the access requirement to the secure data resource is associated with the task request,
wherein the indication of the acceptance is included in the task request, and
wherein the task of the task request includes an operation required on the secure data resource.
8. A method for authorizing access by a remote principal of a second domain to a secure data resource in a first domain, the method comprising:
generating a data structure that specifies a group, at and associated with the second domain, that is based on an access requirement to the secure data resource in the first domain of a domain host, the first domain being different from the second domain;
retrieving a permissions template generated at the second domain, the permissions template defining a set of permissions that include at least one entitlement for members of the group to the secure data resource;
generating an access policy of the secure data resource that is associated with the set of permissions;
providing the set of permissions and the access policy to the domain host for the first domain, the set of permissions and the access policy being immutable from the first domain; and
providing to the first domain on behalf of the remote principal, as a member of the group, an access permission approval request for the secure data resource causing generation in a directory of the first domain at the domain host of a remote principal object based at least on an indication of an approval of the access permission approval request from the first domain, the remote principal object linking the group to the at least one entitlement for the secure data resource as enumerated in the set of permissions and specified by the access policy.
9. The method of claim 8 , the method comprising:
receiving a subsequent access permission approval request from the remote principal or another member of the group subsequent to said providing to the first domain on behalf of the remote principal the access permission approval request;
determining at least one of:
the approval remaining valid, or
the remote principal object remaining valid in the directory; and
notifying the remote principal or the other member of the group of an effective approval for the subsequent access permission approval request.
10. The method of claim 8 , the method comprising:
receiving a request from the remote principal for addition to the group;
verifying credentials of the remote principal against a group access policy that is specific to the group and that is stored at the second domain; and
adding the remote principal to the group by storing remote principal information in the data structure.
11. The method of claim 8 , the method comprising:
receiving the indication of the approval of the access permission approval request; and
providing a notification of the approval to the remote principal in the second domain.
12. The method of claim 8 , wherein the access policy specifies a temporal validity period for the remote principal object; and
the method comprising:
causing a removal of the set of permissions and the access policy at the domain host for the first domain based on at least one of:
receiving an access permission revocation from the first domain, or
an expiration of the temporal validity period.
13. The method of claim 8 , the method comprising:
prior to said generating the data structure, receiving a task request from the first domain, wherein the access requirement to the secure data resource is associated with the task request and a task of the task request includes an operation required on the secure data resource; and
causing a removal of the set of permissions and the access policy at the domain host for the first domain based on a completion indication for the task.
14. The method of claim 8 , the method comprising:
prior to said generating the data structure, receiving a task request from the first domain,
wherein the access requirement to the secure data resource is associated with the task request,
wherein the indication of the acceptance is included in the task request, and
wherein a task of the task request includes an operation required on the secure data resource.
15. At least one computer-readable storage medium that stores program instructions that, when executed by one or more processing devices, performs a method for authorizing access by a remote principal of a second domain to a secure data resource of a first domain, the method comprising:
generating a data structure that specifies a group, at and associated with the second domain, that is based on an access requirement to the secure data resource in the first domain of a domain host, the first domain being different from the second domain;
retrieving a permissions template generated at the second domain, the permissions template defining a set of permissions that include at least one entitlement for members of the group to the secure data resource;
generating an access policy of the secure data resource that is associated with the set of permissions;
providing the set of permissions and the access policy to the domain host for the first domain, the set of permissions and the access policy being immutable from the first domain; and
providing to the first domain on behalf of the remote principal, as a member of the group, an access permission approval request for the secure data resource causing generation in a directory of the first domain at the domain host of a remote principal object based at least on an indication of an approval of the access permission approval request from the first domain, the remote principal object linking the group to the at least one entitlement for the secure data resource as enumerated in the set of permissions and specified by the access policy.
16. The at least one computer-readable storage medium of claim 15 , wherein the method comprises:
receiving a subsequent access permission approval request from the remote principal or another member of the group subsequent to said providing to the first domain on behalf of the remote principal the access permission approval request;
determining at least one of:
the approval remaining valid, or
the remote principal object remaining valid in the directory; and
notifying the remote principal or the other member of the group of an effective approval for the subsequent access permission approval request.
17. The at least one computer-readable storage medium of claim 15 , wherein the method comprises:
receiving a request from the remote principal for addition to the group;
verifying credentials of the remote principal against a group access policy that is specific to the group and that is stored at the second domain; and
adding the remote principal to the group by storing remote principal information in the data structure.
18. The at least one computer-readable storage medium of claim 15 , wherein the access policy specifies a temporal validity period for the remote principal object; and
wherein the method comprises:
causing a removal of the set of permissions and the access policy at the domain host for the first domain based on at least one of:
receiving an access permission revocation from the first domain, or
an expiration of the temporal validity period.
19. The at least one computer-readable storage medium of claim 15 , wherein the method comprises:
prior to said generating the data structure, receiving a task request from the first domain, wherein the access requirement to the secure data resource is associated with the task request and a task of the task request includes an operation required on the secure data resource; and
causing a removal of the set of permissions and the access policy at the domain host for the first domain based on a completion indication for the task.
20. The at least one computer-readable storage medium of claim 15 , wherein the method comprises:
prior to said generating the data structure, receiving a task request from the first domain,
wherein the access requirement to the secure data resource is associated with the task request,
wherein the indication of the acceptance is included in the task request, and
wherein a task of the task request includes an operation required on the secure data resource.