Dynamic Cloud Account Mapping for SaaS Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional role-based access control technologies face challenges in implementing and managing access across multiple Software-as-a-Service (SaaS) platforms due to non-standardized application programming interfaces (APIs) and varying permission setups, leading to inefficiencies and increased costs for enterprises with unused accounts.
Innovation Solution
A system that provides role-based access control using dynamically shared cloud accounts, where a processor and memory-based system authenticates users and maps them to pseudo accounts with corresponding access privileges, allowing single sign-on access and dynamic mapping to available accounts, even if initial accounts are unavailable, thereby optimizing account usage and reducing the number of required cloud accounts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If Enterprises pay for an account for each employee in SaaS services, then access coverage is improved, but cost increases due to billing for all active accounts regardless of use
Solution Approach 1:
Multiple employee accounts are merged into a single shared cloud account that can be dynamically assigned to different users based on their roles and permissions. This consolidation reduces the total number of accounts from N (one per employee) to 1 (shared account), eliminating costs for unused accounts while maintaining access coverage through dynamic user assignment.
Solution Approach 2:
The shared cloud account is designed to serve multiple functions and multiple users sequentially. It can be assigned to different employees based on their current role requirements, making a single account universal rather than dedicated to one user. This multi-functionality allows the same account to provide appropriate access levels to different users as needed.
2Reliability
If separate accounts are set up for each SaaS platform, then platform-specific access control is improved, but device complexity increases due to non-generic APIs and varying permission setups
Solution Approach 1:
An intermediary layer (the shared account management system) is introduced between users and multiple SaaS platforms. This intermediary handles the complexity of different APIs and permission setups by providing a unified interface for role-based access control. The system translates generic role assignments into platform-specific permissions, shielding users from the underlying complexity of each SaaS provider's authentication mechanism.
Solution Approach 2:
A single shared account system is designed to work universally across multiple different SaaS platforms despite their non-generic APIs. The system provides platform-agnostic role-based access control that can be applied consistently across Salesforce, Workday, and other SaaS services, reducing the need for separate account setups for each platform.
3Adaptability or versatility
If dynamic mapping to pseudo accounts is implemented, then account availability and flexibility are improved, but mapping complexity increases
Solution Approach 1:
The account mapping system is designed to be dynamic rather than static. Pseudo accounts can be automatically assigned and reassigned to different users based on current availability and role requirements. This dynamic behavior allows the system to adapt to changing user needs and account availability without manual reconfiguration, improving flexibility despite the inherent complexity of real-time mapping.
Data Source
AI summary
A server computer system within a network of an organization receives a request from a user to access a cloud account. The request includes a user identifier. The server computer system authenticates the user for access to the cloud account based on the user identifier, identifies one or more predetermined roles associated with the cloud account for the user, and identifies one or more pseudo accounts associated with the cloud account. The server computer system further maps the user to the one or more pseudo accounts, and provides user access to the cloud account based on the mapping and with access privileges corresponding to the one or more pseudo accounts.