Cross Cloud Tenant Discovery via Directory Service Query
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Identifying and authenticating users in a sovereign cloud within a non-isolated public cloud computing environment is technologically challenging, requiring manual configuration and posing hurdles for developers due to the need to restrict data access and enforce isolation.
Innovation Solution
A computer-implemented method that queries a directory service to determine the computing environment a user belongs to, allowing authentication and authorization in a non-isolated public cloud while respecting the isolated scope of sovereign clouds, using a security token service to manage user access across multiple cloud environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual configuration is used to identify users in sovereign clouds, then authentication can be achieved, but device complexity and difficulty of operation increase significantly
Solution Approach 1:
The public application automatically queries the directory service to discover which sovereign cloud a user belongs to, eliminating the need for manual configuration. The system self-configures by receiving the user's domain name, querying the directory service for the mapping, and automatically routing authentication to the appropriate security endpoint.
Solution Approach 2:
A directory service acts as an intermediary between the public application and multiple sovereign clouds. The directory service stores mappings between domain names and computing environments, enabling the public application to discover user affiliations without direct configuration of each sovereign cloud connection.
2Measurement precision
If manual configuration is required for each public application, then authentication accuracy is maintained, but productivity decreases
Solution Approach 1:
The directory service provides a universal solution that serves all public applications simultaneously. Instead of configuring each application individually, the directory service maintains a centralized mapping that any public application can query, enabling one configuration to serve multiple applications and significantly improving deployment productivity.
Solution Approach 2:
The directory service intermediary enables public applications to discover user affiliations dynamically without manual configuration. By querying the directory service with a user's domain name, applications can automatically determine the appropriate sovereign cloud, maintaining accuracy while eliminating repetitive configuration work.
3Reliability
If data access is restricted to maintain sovereign cloud isolation, then security is improved, but ease of operation deteriorates
Solution Approach 1:
The directory service acts as an intermediary that enables secure access management across sovereign clouds. By querying the directory service for user affiliation information, the public application can automatically determine which security endpoint to contact, maintaining sovereign cloud isolation while simplifying access management for users and developers.
Solution Approach 2:
The system automatically manages cross-cloud access by querying the directory service and routing users to the appropriate sovereign cloud security endpoint. This self-service approach maintains security boundaries while eliminating the operational burden of manual access configuration.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
A computer-implemented method for a security endpoint of a non-isolated computing environment includes receiving a request related to a non-isolated application. The method includes querying a directory service according to a domain name of a user specified in the request. The directory service stores a mapping between domain names and computing environments, including isolated computing environments and the non-isolated computing environment. The method includes receiving, from the directory service, an indication of a first computing environment. The method includes generating and sending a response to allow the user to be authenticated to the application. In response to the first computing environment being the non-isolated computing environments, the response indicates that the user belongs to the non-isolated computing environment. In response to the first computing environment being one of the isolated computing environments, the response indicates that the user does not belong to the non-isolated computing environment.