Multi-tenant two-stage authentication
Disclosed are some implementations of systems, apparatus, methods and computer program products for implementing a scalable computing system. The scalable computing system includes an intermediate system that facilitates communications between a core server system and a third-party system. The core server system processes a client request for a third-party service in association with a web page having a corresponding web address. The intermediate system communicates with the core server system to obtain a session token, and transmits the session token and web address to the third-party system. The third-party system may then access the web page via the web address using the session token.
1. A method, comprising:
processing, by a server system, a client request associated with a web page, the client request being received from a client device;
responsive to the client request, transmitting, by the server system, a third-party service request including a web address associated with the web page and authentication information to an intermediate system, the third-party service request being a request for a third-party service, the authentication information including a user identifier and a tenant identifier associated with a tenant of a multi-tenant database;
processing, by the server system, a cloud session token request received from the intermediate system, the cloud session token request including the tenant identifier;
responsive to processing the cloud session token request, generating, by the server system, a cloud session token using the tenant identifier;
transmitting, by the server system, the cloud session token to the intermediate system;
processing, by the server system, a session token request received from the intermediate system, the session token request including the user identifier and the cloud session token;
authenticating the session token request using the cloud session token;
responsive to authenticating the session token request, generating, by the server system, a session token using the user identifier;
transmitting, by the server system, the session token to the intermediate system responsive to the session token request;
processing, by the server system, a web page request including the web address and session token, the web page request being received from a third-party system, wherein the session token is not provided by the server system directly to the third-party system;
authenticating, by the server system, the web page request using the session token;
responsive to authenticating the web page request, transmitting, by the server system, the web page to the third-party system; and
obtaining, by the server system, results generated by the third-party system in association with the web page.
2. The method of claim 1 , further comprising:
processing, by a server system, a login request received from a client device, the login request including credentials;
authenticating, by the server system, a user of the client device using the credentials, the credentials including a username and password, wherein the credentials are not provided to the intermediate system or the third-party system.
3. The method of claim 1 , further comprising:
transmitting, by the intermediate system, a message including the session token and web address to the third-party service.
4. The method of claim 3 , wherein transmitting the message comprises providing the message via a queue.
5. The method of claim 1 , further comprising:
configuring, by the server system, a token lifetime associated with the session token;
wherein authenticating the web page request using the session token includes verifying that the session token has not expired.
6. The method of claim 1 , further comprising:
obtaining the cloud session token from a header of the session token request;
wherein authenticating the session token request includes validating the obtained cloud session token.
7. The method of claim 1 , the session token request being received from the intermediate system via an application programming interface (API).
8. A system comprising:
a database system including a processor and memory, the database system implemented using a server system, the database system configurable to cause:
processing, by the server system, a client request associated with a web page, the client request being received from a client device;
responsive to the client request, transmitting, by the server system, a third-party service request including a web address associated with the web page and authentication information to an intermediate system, the third-party service request being a request for a third-party service, the authentication information including a user identifier and a tenant identifier associated with a tenant of a multi-tenant database;
processing, by the server system, a cloud session token request received from the intermediate system, the cloud session token request including the tenant identifier;
responsive to processing the cloud session token request, generating, by the server system, a cloud session token using the tenant identifier;
transmitting, by the server system, the cloud session token to the intermediate system;
processing, by the server system, a session token request received from the intermediate system, the session token request including the user identifier and the cloud session token;
authenticating the session token request using the cloud session token;
responsive to authenticating the session token request, generating, by the server system, a session token using the user identifier;
transmitting, by the server system, the session token to the intermediate system responsive to the session token request;
processing, by the server system, a web page request including the web address and session token, the web page request being received from a third-party system, wherein the session token is not provided by the server system directly to the third-party system;
authenticating, by the server system, the web page request using the session token;
responsive to authenticating the web page request, transmitting, by the server system, the web page to the third-party system; and
obtaining, by the server system, results generated by the third-party system in association with the web page.
9. The system of claim 8 , the database system further configurable to cause:
processing, by a server system, a login request received from a client device, the login request including credentials;
authenticating, by the server system, a user of the client device using the credentials, the credentials including a username and password, wherein the credentials are not provided to the intermediate system or the third-party system.
10. The system of claim 8 , the database system further configurable to cause:
transmitting, by the intermediate system, a message including the session token and web address to the third-party service.
11. The system of claim 10 , wherein transmitting the message comprises providing the message via a queue.
12. The system of claim 8 , the database system further configurable to cause:
configuring, by the server system, a token lifetime associated with the session token;
wherein authenticating the web page request using the session token includes verifying that the session token has not expired.
13. The system of claim 8 , the database system further configurable to cause:
obtaining the cloud session token from a header of the session token request;
wherein authenticating the session token request includes validating the obtained cloud session token.
14. The system of claim 8 , the session token request being received from the intermediate system via an application programming interface (API).
15. A non-transitory computer-readable medium storing computer-readable instructions that, when executed, cause one or more processors to perform steps comprising:
processing, by a server system, a client request associated with a web page, the client request being received from a client device;
responsive to the client request, transmitting, by the server system, a third-party service request including a web address associated with the web page and authentication information to an intermediate system, the third-party service request being a request for a third-party service, the authentication information including a user identifier and a tenant identifier associated with a tenant of a multi-tenant database;
processing, by the server system, a cloud session token request received from the intermediate system, the cloud session token request including the tenant identifier;
responsive to processing the cloud session token request, generating, by the server system, a cloud session token using the tenant identifier;
transmitting, by the server system, the cloud session token to the intermediate system;
processing, by the server system, a session token request received from the intermediate system, the session token request including the user identifier and the cloud session token;
authenticating the session token request using the cloud session token;
responsive to authenticating the session token request, generating, by the server system, a session token using the user identifier;
transmitting, by the server system, the session token to the intermediate system responsive to the session token request;
processing, by the server system, a web page request including the web address and session token, the web page request being received from a third-party system, wherein the session token is not provided by the server system directly to the third-party system;
authenticating, by the server system, the web page request using the session token;
responsive to authenticating the web page request, transmitting, by the server system, the web page to the third-party system; and
obtaining, by the server system, results generated by the third-party system in association with the web page.
16. The non-transitory computer-readable medium of claim 15 , the non-transitory computer-readable medium storing computer-readable instructions that, when executed, cause one or more processors to perform steps further comprising:
processing, by a server system, a login request received from a client device, the login request including credentials;
authenticating, by the server system, a user of the client device using the credentials, the credentials including a username and password, wherein the credentials are not provided to the intermediate system or the third-party system.
17. The non-transitory computer-readable medium of claim 15 , the non-transitory computer-readable medium storing computer-readable instructions that, when executed, cause one or more processors to perform steps further comprising:
transmitting, by the intermediate system, a message including the session token and web address to the third-party service.
18. The non-transitory computer-readable medium of claim 17 , wherein transmitting the message comprises providing the message via a queue.
19. The non-transitory computer-readable medium of claim 15 , the non-transitory computer-readable medium storing computer-readable instructions that, when executed, cause one or more processors to perform steps further comprising:
configuring, by the server system, a token lifetime associated with the session token;
wherein authenticating the web page request using the session token includes verifying that the session token has not expired.
20. The non-transitory computer-readable medium of claim 15 , the non-transitory computer-readable medium storing computer-readable instructions that, when executed, cause one or more processors to perform steps further comprising:
obtaining the cloud session token from a header of the session token request;
wherein authenticating the session token request includes validating the obtained cloud session token.