System and method for externally-delegated access control and authorization

Abstract

Methods for externally-delegated access control and authorization of applications and resources are performed by systems and devices. A request for access by a user to a resource of a first application is received from a client device. A memory data structure that associates the resource of the first application with an application identifier and permission information is accessed to obtain the application identifier and the permission information. A query is provided to a second application, identified by the application identifier, which has a different authorization model than the first application. The query includes a user identifier and the permission information. The second application performs a permission check and authorization for the user based on the query. A query response that includes an access indication is the received from the second application. The request is granted or denied based on the access indication.

What is claimed is: 
     
         1 . An access control and authorization system comprising:
 a processor; and   a memory that stores program code of a first application of a service host, the program code of the first application being configured to be executed by the processor, the program code of the first application including:
 first program code configured to:
 receive, from a client device, a request for access to a resource of the first application; 
 
 second program code configured to:
 obtain an application identifier and permission information from a memory data structure that associates the resource of the first application with the application identifier and the permission information; 
 
 third program code configured to:
 provide a query to a second application identified by the application identifier, the query including an identifier and the permission information, and 
 receive, from the second application, a query response that includes an access indication; and 
 
 fourth program code configured to:
 grant the request based on the access indication including a grant indication. 
 
   
     
     
         2 . The system of  claim 1 , wherein the permission information is associated with a resource of the second application that is referenced by the first application. 
     
     
         3 . The system of  claim 2 , wherein the second application has a different authorization model than the first application. 
     
     
         4 . The system of  claim 1 , wherein at least one of the first application or the second application is a software-as-a-service (SaaS) application. 
     
     
         5 . The system of  claim 1 , wherein the fourth program code is further configured to:
 deny the request based on the access indication including a deny indication.   
     
     
         6 . The system of  claim 1 , wherein the request for access is by a user and the identifier is a user identifier;
 wherein the memory data structure also associates another resource of the first application with another application identifier and other permission information of a third application;   wherein the first program code is configured to:
 receive another request for access by another user to the other resource of the first application from another client device; 
   wherein the second program code is configured to:
 obtain the other application identifier and the other permission information from the memory data structure; 
   wherein the third program code is configured to:
 provide another query to the third application identified by the other application identifier, the other query including another user identifier of the other user and the other permission information, and 
 receive, from the third application, another query response that includes another access indication; and 
   wherein the fourth program code is further configured to:
 grant the other request based on the other access indication including another grant indication, and 
 the other request based on the other access indication including another deny indication. 
   
     
     
         7 . The system of  claim 1 , wherein the memory data structure also associates the resource of the first application with another application identifier and other permission information of a third application;
 wherein the third program code is configured to:
 provide an additional query to the third application identified by the other application identifier, the additional query including the identifier and the other permission information, and 
 receive, from the third application, an additional query response that includes an additional access indication; and 
   wherein the fourth program code is configured to:
 grant the request also based on the additional access indication including an additional grant indication, and 
 deny the request also based on the additional access indication including an additional deny indication. 
   
     
     
         8 . A computer-implemented method comprising:
 receiving a request for access to a resource of a first application;   obtaining, from a memory data structure, an application identifier and permission information that associates the resource of the first application with the application identifier and the permission information;   providing a query to a second application that has a different authorization model than the first application, the query including an identifier and the permission information;   receiving, from the second application, a query response that includes an access indication; and   granting the request based on the access indication including a grant indication.   
     
     
         9 . The computer-implemented method of  claim 8 , wherein the first application is an application of a service host, the service host hosting a plurality of applications. 
     
     
         10 . The computer-implemented method of  claim 9 , wherein the permission information is associated with a resource of the second application that is referenced by the first application. 
     
     
         11 . The computer-implemented method of  claim 8 , wherein at least one of the first application or the second application is a software-as-a-service (SaaS) application. 
     
     
         12 . The computer-implemented method of  claim 8 , further comprising:
 denying the request based on the access indication including a deny indication.   
     
     
         13 . The computer-implemented method of  claim 8 , wherein the request for access is by a user and the identifier is a user identifier, and
 wherein the memory data structure also associates another resource of the first application with another application identifier and other permission information of a third application;   the computer-implemented method further comprising:
 receiving another request for access by another user to the other resource of the first application from another client device; 
 obtaining the other application identifier and the other permission information from the memory data structure; 
 providing another query to the third application identified by the other application identifier, the other query including another user identifier of the and the other permission information; 
 receiving, from the third application, another query response that includes another access indication; and 
 granting or denying the other request based on the other access indication including a grant indication or a deny indication, respectively. 
   
     
     
         14 . The computer-implemented method of  claim 8 , wherein the memory data structure also associates the resource of the first application with another application identifier and other permission information of a third application;
 the computer-implemented method further comprising:
 providing an additional query to the third application identified by the other application identifier, the additional query including the identifier and the other permission information; 
 receiving, from the third application, an additional query response that includes an additional access indication; and 
 granting or denying the request also based on the additional access indication including an additional grant indication or an additional deny indication, respectively. 
   
     
     
         15 . A computer-readable storage medium having program instructions recorded thereon that, when executed by a processing device, perform a method for access control and authorization, the method comprising:
 receiving, over a network and from a remote client device, a request for access to a resource of a first application;   obtaining, from a memory data structure, an application identifier and permission information that associates the resource of the first application with the application identifier and the permission information;   providing a query over the network to a second application that has a different authorization model than the first application, the query including an identifier and the permission information;   receiving, from the second application, a query response that includes an access indication; and   granting the request based on the access indication including a grant indication.   
     
     
         16 . The computer-readable storage medium of  claim 15 , wherein the first application is an application of a service host, the service host hosting a plurality of applications. 
     
     
         17 . The computer-readable storage medium of  claim 16 , wherein at least one of the first application or the second application is a software-as-a-service (SaaS) application. 
     
     
         18 . The computer-readable storage medium of  claim 15 , wherein the method further comprises:
 denying the request based on the access indication including a deny indication.   
     
     
         19 . The computer-readable storage medium of  claim 15 , wherein the request for access is by a user and the identifier is a user identifier;
 wherein the memory data structure also associates another resource of the first application with another application identifier and other permission information of a third application;   wherein the method further comprises:
 receiving another request for access by another user to the other resource of the first application from another client device; 
 obtaining the other application identifier and the other permission information from the memory data structure; 
 providing another query to the third application identified by the other application identifier, the other query including another user identifier of the and the other permission information; 
 receiving, from the third application, another query that includes another access indication; and 
 granting or denying the other request based on the other access indication including another grant indication or another deny indication, respectively. 
   
     
     
         20 . The computer-readable storage medium of  claim 15 , wherein the memory data structure also associates the resource of the first application with another application identifier and other permission information of a third application; and
 wherein the method further comprises:
 providing an additional query to the third application identified by the other application identifier, the additional query including the identifier and the other permission information; 
 receiving, from the third application, an additional query response that includes an additional access indication; and 
 granting or denying the request also based on the additional access indication including an additional grant indication or an additional deny indication, respectively.