Applications as resource principals or service principals
Techniques are provided for granting an application of a first type of identity system, which uses a first type of identity token, access to a second type of identity system, which uses a second type of identity token. An application can make a request to a token exchange system. The request can include a bearer token and a public key of the application. The token exchange system can exchange the bearer token for a Proof-of-Possession token after performing verification steps. A token exchange system can exchange the first token (e.g., bearer token) for the first identity system for the second token (e.g., Proof-of-Possession token) for the second identity system without requiring entry of credentials to access the second identity system.
1. A method comprising:
determining, by a token exchange system of an integrated identity management system of a cloud service, that an entity is authorized to access a first identity system,
wherein the entity is an application,
wherein the first identity system is in a first domain;
generating, by the token exchange system, a first request for the entity to access a second identity system,
wherein the first request includes a bearer token and a first public key associated with the entity;
verifying, by the token exchange system, that the bearer token is a valid bearer token;
verifying, by the token exchange system, whether a role of the entity is a role that is authorized to access the second identity system;
generating, by the token exchange system, a second token based on the bearer token and the first public key received in the first request;
sending, by the token exchange system to the entity, the second token that is generated based on the bearer token and the first public key received in the first request;
generating, by the token exchange system, a second request for the entity to access the second identity system, wherein the second request comprises the second token; and
verifying, by the token exchange system, the second token and authorizing the entity to access an application programming interface (API) of the second identity system based upon successfully verifying the second token, wherein authorizing the entity to access the API of the second identity system comprises granting entity privileges of a service principal or a resource principal,
wherein the second token is a Proof-of-Possession (POP) token associated with the second identity system, and the second token includes the first public key of the entity,
wherein the second identity system is in a second domain different from the first domain.
2. The method according to claim 1 , further comprising:
verifying, by the token exchange system, that the entity has an identity that is authorized to access the second identity system; and
authorizing, by the token exchange system, the entity to access the second identity system based upon verifying that the entity has an identity that is authorized to access the second identity system,
wherein the second request is signed by a private key of the entity.
3. The method according to claim 2 , wherein verifying that the entity has the identity that is authorized to access the second identity system comprises:
verifying, by the token exchange system, that the entity is the entity that signed the second request; and
verifying, by the token exchange system, that the second token is authorized to access the second identity system.
4. The method according to claim 1 , wherein authorizing the entity to access the second identity system comprises granting the entity privileges of a resource principal.
5. The method according to claim 1 , wherein authorizing the entity to access the second identity system comprises granting the entity privileges of a service principal.
6. The method according to claim 4 , wherein the resource principal is authorized to access resources of the second identity system.
7. The method according to claim 5 , wherein the service principal is authorized to access services of the second identity system.
8. The method according to claim 1 , wherein the entity is authorized to access the application programming interface (API) of the second identity system using the second token without requiring entry of entity credentials in the second identity system.
9. The method according to claim 2 , wherein the entity is determined to be authorized to access the first identity system based on credentials of the entity for the first identity system.
10. The method according to claim 1 , wherein the first identity system has a first system model, and wherein the second identity system has a second system model that has different specifications from the first system model.
11. The method according to claim 1 , wherein the entity is an integrated cloud service application.
12. The method according to claim 11 , wherein the integrated cloud service application is a SaaS application, a PaaS application or a fusion application.
13. A computer-program product tangibly embodied in one or more non-transitory machine-readable media, including instructions configured to cause one or more data processors to perform a method comprising:
determining, by a token exchange system of an integrated identity management system of a cloud service, that an entity is authorized to access a first identity system,
wherein the entity is an application,
wherein the first identity system is in a first domain;
generating, by the token exchange system, a first request for the entity to access a second identity system, wherein the first request includes a bearer token and a first public key associated with the entity;
verifying, by the token exchange system, that the bearer token is a valid bearer token;
verifying, by the token exchange system, whether a role of the entity is a role that is authorized to access the second identity system;
generating, by the token exchange system, a second token based on the bearer token and the first public key received in the first request;
sending, by the token exchange system to the entity, the second token that is generated based on the bearer token and the first public key received in the first request;
generating, by the token exchange system, a second request for the entity to access the second identity system, wherein the second request comprises the second token; and
verifying, by the token exchange system, the second token and authorizing the entity to access an application programming interface (API) of the second identity system based upon successfully verifying the second token, wherein authorizing the entity to access the API of the second identity system comprises granting entity privileges of a service principal or a resource principal,
wherein the second token is a Proof-of-Possession (POP) token associated with the second identity system, and the second token includes the first public key of the entity,
wherein the second identity system is in a second domain different from the first domain.
14. The computer-program product according to claim 13 , further comprising:
verifying, by the token exchange system, that the entity has an identity that is authorized to access the second identity system; and
authorizing, by the token exchange system, the entity to access the second identity system based upon verifying that the entity has an identity that is authorized to access the second identity system,
wherein the second request is signed by a private key of the entity.
15. The computer-program product according to claim 14 , wherein verifying that the entity has the identity that is authorized to access the second identity system comprises:
verifying, by the token exchange system, that the entity is the entity that signed the second request; and
verifying, by the token exchange system, that the second token is authorized to access the second identity system.
16. A system comprising:
one or more data processors; and
one or more non-transitory computer readable media storing instructions which, when executed by the one or more data processors, cause the one or more data processors to perform a method comprising:
determining, by a token exchange system of an integrated identity management system of a cloud service, that an entity is authorized to access a first identity system,
wherein the entity is an application,
wherein the first identity system is in a first domain;
generating, by the token exchange system, a first request for the entity to access a second identity system, wherein the first request includes a bearer token and a first public key associated with the entity;
verifying, by the token exchange system, that the bearer token is a valid bearer token;
verifying, by the token exchange system, whether a role of the entity is a role that is authorized to access the second identity system;
generating, by the token exchange system, a second token based on the bearer token and the first public key received in the first request;
sending, by the token exchange system to the entity, the second token that is generated based on the bearer token and the first public key received in the first request;
generating, by the token exchange system, a second request for the entity to access the second identity system, wherein the second request comprises the second token; and
verifying, by the token exchange system, the second token and authorizing the entity to access an application programming interface (API) of the second identity system based upon successfully verifying the second token, wherein authorizing the entity to access the API of the second identity system comprises granting entity privileges of a service principal or a resource principal,
wherein the second token is a Proof-of-Possession (POP) token associated with the second identity system, and the second token includes the first public key of the entity,
wherein the second identity system is in a second domain different from the first domain.
17. The system according to claim 16 , further comprising:
verifying, by the token exchange system, that the entity has an identity that is authorized to access the second identity system; and
authorizing, by the token exchange system, the entity to access the second identity system based upon verifying that the entity has an identity that is authorized to access the second identity system,
wherein the second request is signed by a private key of the entity.
18. The system according to claim 17 , wherein verifying that the entity has the identity that is authorized to access the second identity system comprises:
verifying, by the token exchange system, that the entity is the entity that signed the second request; and
verifying, by the token exchange system, that the second token is authorized to access the second identity system.
19. The method according to claim 1 , wherein the first identity system is an Identity Cloud Service (IDCS) system, and wherein the second identity system is an Infrastructure Identity and Access Management (IAM) system.