Cloud Access Manager Aggregating Subaccount Authorizations
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Managing permissions across multiple tenants, cloud platform deployments, and subaccounts in a cloud platform computing system is challenging due to increased latency caused by querying each deployment for user authorization scopes, degrading the user experience.
Innovation Solution
An access manager system aggregates authorizations using subaccount access maps, correlating groups with subaccounts and scopes, allowing users to access authorized subaccounts without querying each deployment, thereby reducing latency and improving user experience.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If the system queries each cloud platform deployment for user authorization scopes, then authorization accuracy is maintained, but network latency increases and user experience degrades
Solution Approach 1:
The system performs preliminary actions by maintaining subaccount access maps that pre-correlate groups with subaccounts and scopes across multiple cloud platform deployments. When a user logs on, the access manager system can quickly determine authorization by checking these pre-established maps rather than querying each deployment in real-time, thus resolving the contradiction between authorization accuracy and network latency
Solution Approach 2:
The system creates copies of authorization data in the form of subaccount access maps stored at the access manager system. These maps replicate the authorization relationships from multiple cloud platform deployments, allowing the system to perform authorization checks locally without repeatedly querying the original deployments, thereby reducing latency while maintaining authorization accuracy
2Loss of information
If the system queries each deployment for user authorization, then complete authorization information is obtained, but network traffic and processor load increase
Solution Approach 1:
The system merges authorization data from multiple cloud platform deployments into unified subaccount access maps at the access manager system. By consolidating group-subaccount-scope correlations from various deployments into a single centralized structure, the system can provide complete authorization information through a single query rather than multiple separate queries, thus reducing network traffic and processor load while maintaining information completeness
Solution Approach 2:
The subaccount access maps serve as an intermediary between the user authentication request and the multiple cloud platform deployments. The access manager system uses these maps to determine authorization without directly querying each deployment, acting as a mediator that provides complete authorization information while minimizing network traffic and processor load on the underlying deployments
Data Source
AI summary
Various examples are directed to a cloud platform system that comprises a plurality of cloud platform deployments including a first cloud platform deployment implemented at a first geographic region and a second cloud platform deployment implemented at a second geographic region. An access manager system receives from a user computing device, a user logon request identifying a user. The access manager system also receives, from an identity provider system, group data associated with the user logon request, the group data indicating a first group to which the user belongs. The access manager system determines that a subaccount access map correlates the first group to a first subaccount that is implemented at the first cloud platform deployment. The access manager system also provides the user computing device an indication that the user is authorized to access the first subaccount.