Organization level identity management
User identities can managed at an organization level, instead of across multiple individual resource accounts. In a resource provider environment, access to various resources and services may require users to have identities with specific resource accounts. Users can instead be associated with organization accounts, or virtual accounts that are not associated with specific resources or services. The organization accounts are attached at the appropriate location(s) in an organizational hierarchy. A user having an organization account can project the identity in any sub-account in the organization hierarchy. This can include any lower-level resource account, or can child accounts under a relevant branch of the hierarchy. A user can validate against the organization account, and receive access to the relevant service or resources using the identity projected in the corresponding resource account.
1. A computer-implemented method, comprising:
determining that a user does not have access to a resource;
identifying an organization account without access to or without an ability to directly access the resource, wherein the user has a user identity with the organization account and wherein the organization account is attachable to different resource accounts;
identifying one resource account of the different resource accounts that has authorization to access the resource;
determining that the one resource account is attached as a sub-account of the organization account in an organizational hierarchy; and
granting access to the resource, wherein the access is enabled for the organization account by a call from within the one resource account.
2. The computer-implemented method of claim 1 , further comprising
adding the user to a group of users associated with the organization account; and
using the association of the user to the group of users for the granting of the access to the user for the resource from within the one resource account.
3. The computer-implemented method of claim 1 , further comprising:
receiving a request for the access to the resource using a session token;
verifying the request based on the session token, in part, to enable the granting of the access to the resource for the user.
4. The computer-implemented method of claim 3 , wherein the verifying of the request comprises:
initiating a current session; and
determining that the current session matches a session for which the session token is valid.
5. The computer-implemented method of claim 4 , further comprising:
storing information related to the current session; and
verifying a subsequent request to access the resource based on the information.
6. The computer-implemented method of claim 5 , wherein the information is stored separately from the session token.
7. The computer-implemented method of claim 5 , wherein the session token includes the information related to the current session.
8. The computer-implemented method of claim 1 , further comprising:
determining that the resource is available; and
provisioning the resource for a current session following the granting of the access to the resource by a call from within the one resource account.
9. The computer-implemented method of claim 1 , further comprising:
creating a master account;
organizing the different resource accounts as sub-accounts under the master account in the organizational hierarchy; and
enabling user identities that include the user identity of the user and that is associated with the organization account to be attached one or more points in the organizational hierarchy and to be moved at any time.
10. The computer-implemented method of claim 1 , further comprising:
receiving a request for the access the resource, wherein the request includes a resource amount;
enabling, responsive to the request, the granting of the access to the resource, at the resource amount, for the user.
11. The computer-implemented method of claim 10 , wherein the resource amount is one of a number of tasks that to be performed, a period of time that access is required, and a renewal requirement.
12. A non-transitory computer readable medium comprising instructions that when executed by at least one processor enable the at least one processor to:
determine that a user does not have access to a resource;
identify an organization account without access to or without an ability to directly access the resource, wherein the user has a user identity with the organization account and wherein the organization account is attachable to different resource accounts;
identify one resource account of the different resource accounts that has authorization to access the resource;
attach the one resource account as a sub-account of the organization account in an organizational hierarchy; and
grant access for the organization account to the resource by a call from within the one resource account.
13. The non-transitory computer readable medium of claim 12 , wherein the instructions that when executed by the at least one processor further enable the at least one processor to:
add the user to a group of users associated with the organization account; and
use the association of the user to the group of users for the granting of the access to the user for the resource from within the one resource account.
14. The non-transitory computer readable medium of claim 12 , wherein the instructions that when executed by the at least one processor further enable the at least one processor to:
receive a request for the access the resource using a session token;
verify the request based on the session token, in part, to enable the granting of the access to the resource for the user.
15. The non-transitory computer readable medium of claim 14 , wherein the instructions that when executed by the at least one processor further enable the at least one processor to:
initiate a current session; and
determine that the current session matches a session for which the session token is valid.
16. The non-transitory computer readable medium of claim 15 , wherein the instructions that when executed by the at least one processor further enable the at least one processor to:
store information related to the current session; and
verify a subsequent request to access the resource based on the information.
17. The non-transitory computer readable medium of claim 12 , wherein the instructions that when executed by the at least one processor further enable the at least one processor to:
determine that the resource is available; and
provision the resource for a current session following the granting of the access to the resource by a call from within the one resource account.
18. A system, comprising:
at least one processor; and
memory including instructions that, when executed by the at least one processor, cause the system to:
determine that a user does not have access to a resource;
identify an organization account without access to or without an ability to directly access the resource, wherein the user has a user identity with the organization account and wherein the organization account is attachable to different resource accounts;
identify one resource account of the different resource accounts that has authorization to access the resource;
attach the one resource account as a sub-account of the organization account in an organizational hierarchy; and
grant access for the organization account to the resource by a call from within the one resource account.
19. The system of claim 18 , wherein the instructions when executed further cause the system to:
add the user to a group of users associated with the organization account; and
use the association of the user to the group of users for the granting of the access to the user for the resource from within the one resource account.
20. The system of claim 18 , wherein the instructions when executed further cause the system to:
receive a request for the access the resource using a session token;
verify the request based on the session token, in part, to enable the granting of the access to the resource for the user.