Multi-tenancy support for enterprise social business computing

• US 9,325,632 B2
• Filed: 03/15/2013
• Issued: 04/26/2016
• Est. Priority Date: 03/15/2013
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Banatwala, Mustansir, Brooks, David Andrew, Lin, Patrick Y., Schaeck, Thomas, Yates, Robert Leslie
• Primary Examiner(s): Winder, Patrice
• Assistant Examiner(s): WIDHALM, ANGELA M
• Application Number:
  US13/841,258
• Publication Number:
  US 20140280939A1
• Time in Patent Office: 1,138 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 47/70 Admission control; Resource allocation
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/306 User profiles

Abstract

Mechanisms are provided for enabling collaboration across tenants in a multi-tenant environment using single sign-on (SSO) authentication/authorization. Various examples provide for creating a user account and provisioning a subscription to a user (e.g., to enable single sign-on authentication/authorization). The user is allowed to access services (e.g., collaborative services) in a multi-tenant environment by utilizing a subscription authorization of the user without prompting the user to authenticate by logging-in again (that is, without prompting the user to log-in again after the user has already logged-in and been authenticated for a given session). Other examples provide for mapping webspaces through URL hosts where each organization (that is, tenant) has its own set of namespace(s).

Claims

1. A computer readable storage device, tangibly embodying a program of instructions executable by the computer for enabling at least a first user to utilize a multi-tenant computing environment, wherein the multi-tenant computing environment comprises at least a first computing resource associated with a first tenant and a second computing resource associated with a second tenant, the program of instructions, when executing, performing the following steps:

assigning a first user account to the first user, wherein the first user account has associated therewith first user account information comprising at least one user account indicium that is unique across the multi-tenant computing environment;

linking to the first user account a first subscription, wherein the first subscription has associated therewith first subscription information;

linking to the first user account a second subscription, wherein the second subscription has associated therewith second subscription information;

receiving from the first user at least the user account indicium in connection with a log-in to the multi-tenant computing environment by the first user;

permitting access to the first computing resource for the first user account based upon the log-in with the user account indicium and the first subscription information of the first subscription that is linked to the first user account; and

permitting access to the second computing resource for the first user account based upon the log-in with the user account indicium and the second subscription information of the second subscription that is linked to the first user account;

wherein a list of subscriptions for the first user account determines whether the first user account can move among different tenants;

wherein, in the event of inactivation of the first user account, the first subscription cannot be used to access the first computing resource and the second subscription cannot be used to access the second computing resource;

wherein, in the event of reactivation of the first user account after being deactivated, all user application data will again be available to the first user account; and

wherein, in the event of termination of the first user account, all user application data will be deleted.

2. The computer readable storage device of claim 1, wherein the linking of the first subscription and the second subscription to the first user account comprises storing data in a database.

3. The computer readable storage device of claim 1, wherein the first computing resource comprises a first web presence and the second computing resource comprises a second web presence.

4. The computer readable storage device of claim 3, wherein the first web presence comprises at least one webpage and the second web presence comprises at least one webpage.

5. The computer readable storage device of claim 1, wherein:

the first tenant has associated therewith a first namespace;

the second tenant has associated therewith a second namespace that is distinct from the first namespace;

the first computing resource is in the first namespace; and

the second computing resource is in the second namespace.

6. The computer readable storage device of claim 1, wherein after the log-in by the first user, the first user is enabled to collaborate with at least a second user in connection with access to at least one of the first computing resource and the second computing resource.

7. The computer readable storage device of claim 6, wherein the collaborative access for each of the first user and the second user comprises:

(a) file read access;

(b) file write access;

(c) file create access;

or (d) any combination thereof.

8. The computer readable storage device of claim 1, wherein:

the multi-tenant computing environment further comprises at least a third computing resource associated with a third tenant; and

the program of instructions, when executing, prohibiting access to the third computing resource for the first user.

13. The computer readable storage device of claim 1, wherein the at least one user account indicium of the first user account is further static and never re-used for the multi-tenant computing environment.

9. A system for enabling at least a first user to utilize a multi-tenant computing environment, wherein the multi-tenant computing environment comprises at least a first computing resource associated with a first tenant and a second computing resource associated with a second tenant, the system comprising:

a processor; and

a memory storing computer readable instructions that, when executed by the processor, implement;

an assigning element configured to assign a first user account to the first user, wherein the first user account has associated therewith first user account information comprising at least one user account indicium that is unique across the multi-tenant computing environment;

a first linking element configured to link, to the first user account, a first subscription, wherein the first subscription has associated therewith first subscription information;

a second linking element configured to link, to the first user account, a second subscription, wherein the second subscription has associated therewith second subscription information;

a receiving element configured to receive from the first user at least the user account indicium in connection with a log-in to the multi-tenant computing environment by the first user;

a first permitting element configured to permit access to the first computing resource for the first user account based upon the log-in with the user account indicium and the first subscription information of the first subscription that is linked to the first user account; and

a second permitting element configured to permit access to the second computing resource for the first user account based upon the log-in with the user account indicium and the second subscription information of the second subscription that is linked to the first user account;

wherein a list of subscriptions for the first user account determines whether the first user account can move among different tenants;

wherein, in the event of inactivation of the first user account, the first subscription cannot be used to access the first computing resource and the second subscription cannot be used to access the second computing resource;

wherein, in the event of reactivation of the first user account after being deactivated, all user application data will again be available to the first user account; and

wherein, in the event of termination of the first user account, all user application data will be deleted.

10. The system of claim 9, further comprising a database that stores data to link the first subscription and the second subscription to the first user account.

11. The system of claim 9, wherein the first computing resource comprises a first web presence and the second computing resource comprises a second web presence.

12. The system of claim 11, wherein the first web presence comprises at least one webpage and the second web presence comprises at least one webpage.

14. The system of claim 9, wherein the at least one user account indicium of the first user account is further static and never re-used for the multi-tenant computing environment.