Techniques for simultaneously accessing multiple isolated systems while maintaining security boundaries
Techniques are described for using a single application to interact with multiple separate realms simultaneously while maintaining data security boundaries. For example, a web browser may be used to access and interact with the multiple separate secure realms while maintaining data security boundaries between the systems. Multiple concurrent sessions may be established for a user between the web browser and multiple realms. Separate sets of security credentials (e.g., credentials used for authentication and authorization purposes) may be used to establish the sessions and for operations performed in the realms via the sessions. The application can also execute logic (e.g., via machine-executable code or instructions) for automating operations performed in the realms, such as, automating the initiation of a certain operation in one realm based upon a response received from another realm, causing operations to be initiated in two different realms such that the operations overlap in the time; and the like.
1. A method, comprising:
establishing a first session between a first realm and an application and after successful authentication of a user for the first realm, and wherein the application stores a first set of one or more keys for the first session in a first isolated data store;
while the first session is active between the first realm and the application, establishing a second session between a second realm and the application after successful authentication of the user for the second realm, wherein data is not shared between the first realm and the second realm, wherein the application stores a second set of one or more keys for the second session in a second isolated data store that is separate from the first isolated data store, and wherein the application isolates the first session with the first realm from the second session with the second realm so that information is not shared between the first realm and the second realm;
receiving, by the first realm, from the application via the first session and without re-authentication of the user, a first request requesting a first task to be performed in the first realm;
performing, by the first realm, the first task, wherein the first task is for a first tenancy in the first realm;
sending, by the first realm, to the application via the first session, a particular status code generated based on performing the first task;
receiving, by the second realm, from the application via the second session and without re-authentication of the user, a second request requesting a second task to be performed in the second realm, wherein the application sends the second request to the second realm in response to receiving the particular status code from the first realm; and
performing, by the second realm, the second task, wherein the second task is for a second tenancy in the second realm.
2. The method of claim 1 , wherein the first tenancy is for a first customer, and wherein the second tenancy is for a second customer.
3. The method of claim 2 , wherein the first tenancy includes a first compute, a first memory, and first networking resources provided in the first realm by a cloud services provider, and wherein the second tenancy includes a second compute, a second memory, and second networking resources provided in the second realm by the cloud services provider.
4. The method of claim 1 , wherein the first task comprises installing a set of one or more updates at the first realm, and wherein the second task comprises installing the set of one or more updates at the second realm.
5. The method of claim 1 , wherein the particular status code indicates that the first task has completed successfully.
6. The method of claim 1 , wherein the first realm includes a first set of data centers and the second realm includes a second set of data centers.
7. The method of claim 1 , wherein the first task includes at least one of installing a set of one or more updates at the first realm, provisioning a resource, utilizing a resource, updating configurations, and modifying the first tenancy, and wherein the second task includes at least one of installing the set of one or more updates at the first realm, provisioning a resource, utilizing a resource, updating configurations, and modifying the second tenancy.
8. A method, comprising:
establishing a first session between a first realm and an application and after successful authentication of a user for the first realm, and wherein the application stores a first set of one or more keys for the first session in a first isolated data store;
while the first session is active between the first realm and the application, establishing a second session between a second realm and the application after successful authentication of the user for the second realm, wherein the application stores a second set of one or more keys for the second session in a second isolated data store that is separate from the first isolated data store, and wherein the application isolates the first session with the first realm from the second session with the second realm;
receiving, by the first realm, from the application via the first session and without re-authentication of the user, a first request requesting a first task to be performed in the first realm;
performing, by the first realm, the first task, wherein the first task is for a first tenancy in the first realm;
receiving, by the second realm, from the application via the second session and without re-authentication of the user, a second request requesting a second task to be performed in the second realm, wherein the application sends the second request to the second realm after sending the first request and before the first task is completed; and
performing, by the second realm, the second task, wherein the second task is for a second tenancy in the second realm.
9. The method of claim 8 , wherein the application comprises a web browser.
10. The method of claim 8 , further comprising:
verifying, by the first realm, the first request; and
verifying, by the second realm, the second request.
11. The method of claim 10 , wherein verifying the first request includes:
validating a first digital signature; and
wherein verifying the second request includes:
validating a second digital signature.
12. The method of claim 8 , wherein the first task includes at least one of installing a set of one or more updates at the first realm, provisioning a resource, utilizing a resource, updating configurations, and modifying the first tenancy, and wherein the second task includes at least one of installing the set of one or more updates at second first realm, provisioning a resource, utilizing a resource, updating configurations, and modifying the second tenancy.
13. The method of claim 8 , the first tenancy is for a first customer, the first tenancy includes a first compute, a first memory, and first networking resources provided in the first realm by a cloud services provider, the second tenancy is for a second customer, and the second tenancy includes a second compute, a second memory, and second networking resources provided in the second realm by the cloud services provider.
14. The method of claim 8 , wherein the first isolated data store is a first local IndexedDB, and wherein the second isolated data store is a second local IndexedDB.
15. A system comprising:
a first non-transitory computer-readable storage medium, storing first computer-executable instructions that, when executed, cause one or more first processors of a first computer system to perform a first method comprising:
establishing a first session between a first realm and an application and after successful authentication of a user for the first realm, and wherein the application stores a first set of one or more keys for the first session in a first isolated data store;
receiving, from the application via the first session and without re-authentication of the user, a first request requesting a first task to be performed in the first realm;
performing the first task, wherein the first task is for a first tenancy in the first realm; and
sending, to the application via the first session, a particular status code generated based on performing the first task; and
a second non-transitory computer-readable storage medium, storing second computer-executable instructions that, when executed, cause one or more second processors of a second computer system to perform a second method comprising:
while the first session is active between the first realm and the application, establishing a second session between a second realm and the application after successful authentication of the user for the second realm, wherein data is not shared between the first realm and the second realm, wherein the application stores a second set of one or more keys for the second session in a second isolated data store that is separate from the first isolated data store, and wherein the application isolates the first session with the first realm from the second session with the second realm so that information is not shared between the first realm and the second realm;
receiving, from the application via the second session and without re-authentication of the user, a second request requesting a second task to be performed in the second realm, wherein the application sends the second request to the second realm in response to receiving the particular status code from the first realm; and
performing the second task, wherein the second task is for a second tenancy in the second realm.
16. The system of claim 15 , wherein the second request is received at the second realm after the first request is received at the first realm and before the first task is completed at the first realm.
17. The system of claim 16 , wherein the particular status code indicates that the first task was initiated successfully and is currently in progress.
18. The system of claim 15 , wherein the first tenancy is for a first customer, the first tenancy includes a first compute, a first memory, and first networking resources provided in the first realm by a cloud services provider, the second tenancy is for second customer, and the second tenancy includes a second compute, a second memory, and second networking resources provided in the second realm by the cloud services provider.
19. The system of claim 15 , wherein the first task comprises installing a set of one or more updates at the first realm, and wherein the second task comprises installing the set of one or more updates at the second realm.
20. The system of claim 15 , wherein the application comprises a web browser, wherein the web browser stores the first set of one or more keys such that the first set of one or more keys is not extractable, and wherein the web browser stores the second set of one or more keys such that the second set of one or more keys is not extractable.