Cross-Tenant Identity Objects for Unified Permission Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In a multi-tenant environment, users face challenges in accessing resources across different tenants without creating individual guest accounts, leading to inefficiencies and lack of centralized management for resource sharing, which complicates permission configuration and increases computing resources usage.
Innovation Solution
A system that enables cross-tenant access by authenticating users with a user token, determining cross-tenant policies, and forming identity objects based on these policies to manage access permissions dynamically, allowing users to access resources securely without needing separate guest accounts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If guest accounts are manually created for each user to access resources across different tenants, then access permission is granted, but device complexity and time consumption increase due to manual account creation and management
Solution Approach 1:
The patent merges multiple guest accounts into a single unified account. Instead of requiring separate guest accounts for each tenant (User A needs Guest1 for Tenant B, Guest2 for Tenant C), the system creates one unified account that consolidates all cross-tenant access permissions, dramatically simplifying account management while maintaining secure access control across multiple tenants
Solution Approach 2:
The unified account serves multiple functions simultaneously - it acts as a guest account for multiple different tenants, eliminates the need for separate guest accounts, and provides centralized permission management. This multi-functional account resolves the contradiction by making the system more operationally efficient without increasing complexity
2Adaptability or versatility
If multiple guest accounts are created for a user to access different tenants, then resource access is enabled, but computing resources are consumed due to maintaining multiple accounts
Solution Approach 1:
The system merges multiple tenant-specific guest accounts into a single unified account that consolidates all cross-tenant access permissions. This reduces the quantity of accounts from N separate guest accounts to 1 unified account, directly decreasing computing resource consumption while preserving full adaptability for accessing resources across all tenants
3Adaptability or versatility
If manual guest account creation is used for cross-tenant access, then resource sharing is enabled, but productivity decreases due to manual processes
Solution Approach 1:
The system enables self-service for cross-tenant access by allowing users to automatically obtain a unified account that consolidates all necessary guest permissions. Instead of requiring manual administrative creation of multiple guest accounts, the system automatically manages the unified account and its permissions across tenants, dramatically improving productivity while maintaining full resource sharing capability
Data Source
AI summary
A cross-tenant authentication system is described. The system receives a user token from a client device that is registered with a first tenant of a service application of a server. The system receives a request, from the client device, to access a second feature of a second tenant of the service application. The second feature of the second tenant of the service application is separate from a first feature of the first tenant of the service application. The second feature is only accessible to devices registered with the second tenant of the service application. The system authenticates the request by validating the user token from the client device and determines a cross-tenant policy of the second tenant of the service application based on the user token. The system forms an identity object based on the cross-tenant policy.