MULTI-TENANCY USING SUITE OF AUTHORIZATION MANAGER COMPONENTS

• US 20100125612A1
• Filed: 11/14/2008
• Published: 05/20/2010
• Est. Priority Date: 11/14/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Amradkar, Purushottam Shridhar, Fitter, Percy Dara, Chandrasekhar, Arun Ramanathan
• Granted Patent: US 8,271,536 B2
• Time in Patent Office: Days
• US Class Current: 707/802
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

Embodiments described herein are directed to implementing a multi-tenancy service component configured to provide multi-tenancy capabilities for submitted services. In one embodiment, a computer system instantiates a hosting service that includes a multi-tenancy component configured to provide resource access to multiple users through a single multi-tenant resource instance. The computer system receives a submitted service submitted to be hosted by the hosting service. The submitted service includes a portion of use information usable to configure parameters of the multi-tenancy component. The computer system configures the multi-tenancy component to provide resource access for multiple users through a single multi-tenant resource instance, where each user provides a resource instance claim indicating a resource instance level authorization for the user. The computer system also provides resource access to each of the users through the single multi-tenant resource instance, based on the resource instance level authorization included in the resource instance claim.

Claims

1. At a server computer system in a computer networking environment including a plurality of computing systems, a method for implementing a multi-tenancy service component configured to provide multi-tenancy capabilities for submitted services, the method comprising:

an act of instantiating a hosting service that includes a multi-tenancy component configured to provide resource access to a plurality of users through a single multi-tenant resource instance;

an act of receiving a submitted service submitted to be hosted by the hosting service, the submitted service including a portion of use information usable to configure one or more parameters of the multi-tenancy component;

an act of configuring the multi-tenancy component to provide resource access for a plurality of users through a single multi-tenant resource instance, each user providing a resource instance claim indicating a resource instance level authorization for the user; and

an act of providing resource access to each of the users through the single resource instance, based on the resource instance level authorization included in the resource instance claim.

2. The method of claim 1, wherein each user provides a validated security token generated from the users'"'"' credentials.

3. The method of claim 2, further comprising an act of accessing an authentication database to verify that at least two of the users have rights to access resources through the single multi-tenant resource instance based on each user'"'"'s corresponding validated security token.

4. The method of claim 1, wherein the resource instance claim includes a listing of resource instance rights corresponding to each resource provided by the service.

5. The method of claim 1, wherein each authenticated user accesses a customized virtual application instance.

6. The method of claim 1, wherein the validated security token includes an indication that the user is assigned to a role that has access to the single resource instance.

7. The method of claim 6, wherein the role indicates rights for a plurality of users across a federation.

8. The method of claim 1, wherein the rights indicated in the resource instance claim include at least one of read, write and execute.

9. The method of claim 8, further comprising an act of inspecting the resource instance claim to determine the type of access the user is requesting.

10. The method of claim 9, further comprising denying the user access to the resources based on a determination that the user does not have rights for the type of access requested.

11. The method of claim 1, wherein each resource includes a resource identifier linking the resource to one or more resource instance claims.

12. The method of claim 11, wherein the resource identifier is validated against the resource instance claims to determine that the user has access rights of the type requested for the resource requested.

13. The method of claim 1, wherein the multi-tenancy component provides one or more users with an indication of customizable multi-tenancy component parameters that are implementable using use information.

14. A computer program product for implementing a method for implementing a multi-tenancy service component configured to provide multi-tenancy capabilities for submitted services, the computer program product comprising one or more computer-readable storage media having stored thereon computer-executable instructions that, when executed by one or more processors of the computing system, cause the computing system to perform the method, the method comprising:

an act of instantiating an online hosting service that includes a multi-tenancy component configured to provide resource access to a plurality of users through a single multi-tenant resource instance;

an act of receiving a submitted service submitted to be hosted by the online hosting service, the submitted service including a portion of use information usable to configure one or more parameters of the multi-tenancy component;

an act of configuring the multi-tenancy component to provide resource access to resources for a plurality of authenticated users through a single multi-tenant resource instance, each user providing a validated security token generated from the users'"'"' credentials, the security token including a resource instance claim indicating a resource instance level authorization for the user;

an act of accessing an authentication database to verify that at least two of the users have rights to access resources through the single resource instance based on each user'"'"'s corresponding validated security token; and

an act of providing resource access to each of the authenticated users through the single multi-tenant resource instance, based on the resource instance level authorization included in the resource instance claim.

15. The computer program product of claim 14, further comprising an act of receiving a validated security token from a user connected to a different, remote datacenter.

16. The computer program product of claim 15, further comprising accessing an authentication database on the remote datacenter to verify that the user has rights to access resources provided by the online service.

17. The computer program product of claim 14, wherein the online hosting service comprises a plug-in configured to authorize tenants at an operation level.

18. The computer program product of claim 17, wherein the plug-in provides an application programming interface for creating, updating and deleting resource instance claims.

19. A computer system comprising the following:

one or more processors;

system memory;

one or more computer-readable storage media having stored thereon computer-executable instructions that, when executed by the one or more processors, causes the computing system to perform a method for providing a service delivery platform with a multi-tenancy service component configured to provide multi-tenancy capabilities for user-submitted services, the method comprising the following;

an act of instantiating a service delivery platform comprising a plurality of accessible components including a multi-tenancy component configured to provide resources to a plurality of users through a single resource instance;

an act of receiving a user-submitted service submitted by a user for hosting by the service delivery platform, the submitted service including a portion of use information usable to configure one or more parameters of at least one of the platform-provided components including the multi-tenancy component;

an act of configuring the components including the multi-tenancy component according to the provided use information, wherein the multi-tenancy component is configured to provide access to one or more online service resources for a plurality of authenticated users through a single resource instance;

an act of receiving from each user a validated security token generated from the users'"'"' credentials, the security token including a resource instance claim indicating a resource instance level authorization for the user;

an act of accessing an authentication database to verify that at least two of the users have rights to access resources through the single resource instance based on each user'"'"'s corresponding validated security token; and

an act of the service delivery platform providing the online resources to each of the authenticated users through the single resource instance, based on the resource instance level authorization included in the resource instance claim.

20. The computer program product of claim 19, wherein the service delivery platform is part of an online service provided by a datacenter server.