Systems and methods for temporary access with adaptive trust levels for authentication and authorization
One example method includes providing temporary access to a computing system and to providing temporary access as a service. The features of a temporary access can be defined by an entity and a user may be able to obtain a token that includes these features, which may be embedded in the token as claims. The user's access is then controlled in accordance with the embedded claims. The temporary access as a service can be federated. The token may include trust levels and tolerance limits. Further, aspects of the temporary access can be monitored and/or changed. Adjustments to trust levels can be automated or manually performed. Further trust for specific users can be gained or lost over time based on at least previous accesses.
1. A method comprising:
receiving an access request from a user to access a production system, wherein the access request includes a token configured to grant temporary access to the user, wherein the token includes claims that include information about the user including permissions;
granting the temporary access to the user;
monitoring activities of the user in the production system;
generating a session report; and
updating a trust level of the user based on the session report.
2. The method of claim 1 , further comprising revoking the temporary access when an anomaly is detected.
3. The method of claim 2 , wherein the anomaly include detecting that the user attempts to perform an action that is not permitted by the token.
4. The method of claim 2 , further comprising revoking the token upon detecting the anomaly.
5. The method of claim 1 , further comprising starting a session when the temporary access is granted, wherein the temporary access is limited to a time window.
6. The method of claim 1 , wherein monitoring the user includes one of monitoring the user periodically, monitoring the user continually, or monitoring the user upon detecting an anomaly.
7. The method of claim 1 , wherein the token includes a user identifier, a trust level, a tolerance limit, a privilege level, a token identifier, and/or a token valid to from value.
8. The method of claim 1 , further comprising monitoring the user in accordance with a tolerance limit for anomalies, wherein a tolerance limit for a token with low trust level is revoked earlier than a token associated with a higher tolerance limit.
9. The method of claim 1 , further comprising implementing a command delay for commands issued by the user, wherein a length of the command delay depends on the trust level.
10. The method of claim 1 , further comprising:
entering features into an access engine in an admin console for granting temporary access to a user to a production system;
generating the token such that the token includes claims, wherein the claims are based on the features entered into the access engine, wherein the token includes a trust level of the user; and
sending a link that includes or is associated with the token to the user.
11. The method of claim 10 , further comprising sending the features to a token server, wherein the token server generates the token to include the claims and the trust level and a tolerance limit.
12. The method of claim 11 , further comprising determining the trust level based on an account type of the user, wherein the trust level is associated with a credential and previous logins.
13. The method of claim 12 , further comprising determining the tolerance limit based on security and resources.
14. The method of claim 1 , further comprising dynamically adapting the trust level of the user based on updates provided to a federated token server from other entities and performing actions on the temporary access based on the updates.
15. A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:
receiving an access request from a user to access a production system, wherein the access request includes a token configured to grant temporary access to the user, wherein the token includes claims that include information about the user including permissions;
granting the temporary access to the user;
monitoring activities of the user in the production system;
generating a session report; and
updating a trust level of the user based on the session report.
16. The non-transitory storage medium of claim 15 , further comprising:
revoking the temporary access when an anomaly is detected, wherein the anomaly include detecting that the user attempts to perform an action that is not permitted by the token or revoking the token upon detecting the anomaly.
17. The non-transitory storage medium of claim 15 , further comprising starting a session when the temporary access is granted, wherein the temporary access is limited to a time window, wherein monitoring the user includes one of monitoring the user periodically, monitoring the user continually, or monitoring the user upon detecting an anomaly, wherein the token includes a user identifier, a trust level, a tolerance limit, a privilege level, a token identifier, and/or a token valid to from value.
18. The non-transitory storage medium of claim 15 , further comprising monitoring the user in accordance with a tolerance limit for anomalies, wherein a tolerance limit for a token with low trust level is revoked earlier than a token associated with a higher tolerance limit and/or implementing a command delay for commands issued by the user, wherein a length of the command delay depends on the trust level.
19. The non-transitory storage medium of claim 15 , further comprising entering features into an access engine in an admin console for granting temporary access to a user to a production system;
generating the token such that the token includes claims, wherein the claims are based on the features entered into the access engine, wherein the token includes a trust level of the user; and
sending a link that includes or is associated with the token to the user.
20. A method comprising:
receiving an access request from a user to access a production system, wherein the access request includes a token configured to grant temporary access to the user, wherein the token includes claims that include information about the user including permissions;
granting the temporary access to the user;
monitoring activities of the user in the production system; and
revoking the temporary access when an anomaly is detected.