Federated Login With Tenant-Aware RBAC for Object-Level Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional federated login mechanisms are not suitable for multi-tenant deployments, as they fail to enforce tenant-specific role-based access control (RBAC) rules, allowing unauthorized access to data associated with other tenants or sub-tenants.
Innovation Solution
Integrate multi-tenant RBAC schemes with federated login mechanisms by redirecting login requests to a centralized management service, which verifies user credentials and embeds tenant-specific context information in a SAML assertion to enforce RBAC rules across all sub-systems of the DMS.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional federated login mechanisms are used, then login simplicity is maintained, but tenant-specific RBAC rules are not enforced, allowing unauthorized access
Solution Approach 1:
The patent introduces a centralized management service as an intermediary component between the federated login system and the data management system. This service receives authentication results, determines tenant context, translates RBAC rules into object-level permissions, and enforces access control. This intermediary resolves the contradiction by adding security enforcement without requiring changes to the underlying federated login mechanism, maintaining login simplicity while ensuring reliable RBAC compliance.
2Reliability
If multi-tenant RBAC rules are enforced, then data security is improved, but system complexity increases due to additional authentication and authorization layers
Solution Approach 1:
The centralized management service operates autonomously to translate RBAC rules into object-level permissions and enforce access control without requiring manual intervention or complex configuration in each subsystem. The service self-determines tenant context from authentication results, automatically translates permissions, and enforces access control decisions, reducing the perceived complexity for end users and system administrators while maintaining strong security.
3Reliability
If centralized management service is introduced, then RBAC enforcement is achieved, but processing time increases due to additional authentication steps
Solution Approach 1:
The centralized management service performs tenant context determination and permission translation in advance during the authentication phase, before actual data access operations. By pre-computing object-level permissions and caching them, the system avoids repeated translation and lookup operations during subsequent data access, minimizing the time penalty for enforcement while ensuring reliable RBAC compliance.
Data Source
AI summary
Methods, systems, and devices for data management are described. A data management system (DMS) may receive a federated login request from a user associated with one or more tenants of the DMS. The DMS may direct the federated login request to a centralized management service. The DMS may receive a security assertion markup language (SAML) assertion that indicates an identity of the user, a set of object-level permissions assigned to the user, and an identifier of a first tenant associated with the user. The DMS may identify one or more computing objects in a cluster of storage nodes that correspond to the first tenant based on the identifier from the SAML assertion. The DMS may determine that the user is authorized to perform a set of actions on the one or more computing objects based on the set of object-level permissions indicated by the SAML assertion.