Secure resource authorization for external identities using remote principal objects
地域：
WA
WA Redmond
摘要
Methods of secure resource authorization for external identities using remote principal objects are performed by systems and devices. An external entity creates a user group and defines entitlements to an owning entity's secure resource as a set of permissions for the group. An immutable access template with the permissions and an access policy for the secure resource are provided to the owning entity for approval. On approval, a remote principal object is created in the owner directory according to the permissions and access policy. A remote principal that is a group member requests access via an interface to the owner domain using external domain credentials. The identity of the remote principal is verified against the remote principal object by a token service. Verification causes generation and issuance of a token, with the enumerated entitlements, to the remote principal interface affecting a redirect for access to the secure resource.
說明書
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
This application is a continuation of U.S. patent application Ser. No. 16/887,893, filed May 29, 2020, the entirety of which is incorporated by reference herein.
This application is related to U.S. patent application Ser. No. 16/887,985, filed May 29, 2020, (now U.S. Pat. No. 11,233,800, issued Jan. 25, 2022), the entirety of which is incorporated by reference herein.
Owners of data resources often allow external identities access to their data resources for a variety of reasons such as collaboration, technical support, etc. One practice for authorization and access of external identities is for the data resource owner to add an entry in their directory for a particular external identity which enables login access, while other practices include variations on guest credential implementations which also include owner directory entries having limited permissions specific to the data resources to be accessed. In each case, however, the owner of the data resources defines the permissions and is able to alter the types of accesses allowed and the data resources that may be accessed by the external identities.
This Summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.
權(quán)利要求
What is claimed is:1. A system for authorizing access by a remote principal of a second domain to a secure data resource of a first domain of a domain host, the system comprising:a processing system that includes one or more processors; and at least one memory that stores program code to be executed by the processing system to perform a method, the method comprising:verifying that the remote principal is identified as being associated with a group of the second domain represented in a remote principal object stored in a directory of the first domain at the domain host and inaccessible from the second domain, the group having at least one entitlement to the secure data resource as enumerated in a set of permissions and at least one associated access policy defined by the second domain; generating an access token for the remote principal that includes the at least one entitlement; and providing the access token to the remote principal to enable access to the secure data resource by the remote principal. 2. The system of claim 1 , wherein the method further comprises:causing generation of the remote principal object in the directory of the first domain prior to said verifying. 3. The system of claim 2 , wherein said causing generation of the remote principal object is performed based on an acceptance within the first domain of an access permission approval request for the secure data resource that is initiated in and provided on behalf of the second domain. 4. The system of claim 2 , wherein said causing generation of the remote principal object includes determining a temporal validity period associated therewith; andwherein the method further comprises performing at the domain host, and subsequent to an expiration of the temporal validity period, at least one of:removing the remote principal object from the directory; or removing the set of permissions and the at least one associated access policy from the directory. 5. The system of claim 1 , wherein the method further comprises:generating, subsequent to said providing the access token, an audit report including at least one of:one or more entries for operations performed by the remote principal on the secure data resource, or indicia of the set of permissions with which the remote principal object is associated. 6. The system of claim 1 , further comprising:a cloud-based services platform that includes a secure token service configured to generate the access token; wherein the domain host comprises a first tenancy of the cloud-based services platform, and the second domain comprises a second tenancy of the cloud-based services platform. 7. The system of claim 1 , wherein the method comprises:verifying that an entry of an identity of the remote principal is absent from the directory in the first domain and is present in a directory of the second domain. 8. A method for authorizing access by a remote principal of a second domain to a secure data resource of a first domain of a domain host, the method comprising:verifying, by a processing system that includes a processor, that the remote principal is identified as being associated with a group of the second domain represented in a remote principal object stored in a directory of the first domain at the domain host and inaccessible from the second domain, the group having at least one entitlement to the secure data resource as enumerated in a set of permissions and at least one associated access policy defined by the second domain; generating, by the processing system, an access token for the remote principal that includes the at least one entitlement; and providing, by the processing system, the access token to the remote principal to enable access to the secure data resource by the remote principal. 9. The method of claim 8 , wherein the method comprises:causing generation of the remote principal object in the directory of the first domain prior to said verifying. 10. The method of claim 9 , wherein said causing generation of the remote principal object is performed based on an acceptance within the first domain of an access permission approval request for the secure data resource that is initiated in and provided on behalf of the second domain. 11. The method of claim 9 , wherein said causing generation of the remote principal object includes determining a temporal validity period associated therewith; andwherein the method comprises performing at the domain host, and subsequent to an expiration of the temporal validity period, at least one of:removing the remote principal object from the directory; or removing the set of permissions and the at least one associated access policy from the directory. 12. The method of claim 8 , wherein the method comprises:generating, subsequent to said providing the access token, an audit report including at least one of:one or more entries for operations performed by the remote principal on the secure data resource, or indicia of the set of permissions with which the remote principal object is associated. 13. The method of claim 8 , wherein said generating the access token is performed at a cloud-based services platform by a secure token service thereof; andwherein the domain host comprises a first tenancy of the cloud-based services platform, and the second domain comprises a second tenancy of the cloud-based services platform. 14. The method of claim 8 , wherein the method comprises:identifying one or more remote principal objects in the directory of the first domain that are associated with the second domain; and determining at least one of the one or more remote principal objects as having a group attribute; and wherein the remote principal object is included in the at least one of the one or more remote principal objects, and wherein said verifying includes determining that the remote principal is identified as a member of the group as represented in the remote principal object. 15. At least one computer-readable storage medium that stores program instructions that, when executed by one or more processing devices, performs a method for authorizing access by a remote principal of a second domain to a secure data resource of a first domain of a domain host, the method comprising:verifying that the remote principal is identified as being associated with a group of the second domain represented in a remote principal object stored in a directory of the first domain at the domain host and inaccessible from the second domain, the group having at least one entitlement to the secure data resource as enumerated in a set of permissions and at least one associated access policy defined by the second domain; generating an access token for the remote principal that includes the at least one entitlement; and providing the access token to the remote principal to enable access to the secure data resource by the remote principal. 16. The at least one computer-readable storage medium of claim 15 , wherein the method comprises:causing generation of the remote principal object in the directory of the first domain prior to said verifying. 17. The at least one computer-readable storage medium of claim 16 , wherein said causing generation of the remote principal object is performed based on an acceptance within the first domain of an access permission approval request for the secure data resource that is initiated in and provided on behalf of the second domain. 18. The at least one computer-readable storage medium of claim 16 , wherein said causing generation of the remote principal object includes determining a temporal validity period associated therewith; andwherein the method comprises performing at the domain host, and subsequent to an expiration of the temporal validity period, at least one of:removing the remote principal object from the directory; or removing the set of permissions and the at least one associated access policy from the directory. 19. The at least one computer-readable storage medium of claim 15 , wherein said verifying includes determining that the remote principal is also associated with another remote principal object; andwherein said generating the access token for the remote principal that includes the at least one entitlement comprises generating the access token for the remote principal as also including one or more entitlements to another secure data resource associated with the other remote principal object. 20. The at least one computer-readable storage medium of claim 15 , wherein the access token includes an identifier of the remote principal object and does not include a personal identifier of the remote principal.
意見反饋
使用該功能遇到問題