Just-in-Time User Provisioning Framework for Multi-Tenant Database Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multi-tenant database systems, provisioning a large number of users in advance often results in resource wastage due to inactive accounts, while on-demand provisioning can be complex and time-consuming, requiring manual administrator approval.
Innovation Solution
Implementing a just-in-time user provisioning method using single sign-on protocols to automatically create user accounts upon first login, where rules derived from user attributes determine permissions for access to the database system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If user accounts are created in advance in a multi-tenant database system, then users can have immediate access to the system, but many of these accounts may remain inactive resulting in resource wastage
Solution Approach 1:
The system performs preliminary configuration of user account templates with default permissions and attributes before users actually need access. When a user first logs in via single sign-on, the system automatically provisions their account based on these pre-configured templates, eliminating both the waste of creating accounts that never get used and the delay of manual account creation at first login
2Loss of energy
If user accounts are provisioned upon initial user request, then resource wastage is reduced, but the process becomes complicated and time-consuming requiring manual administrator approval
Solution Approach 1:
The system enables self-service provisioning where users automatically create their own accounts by logging in with their organization credentials through the single sign-on protocol. The system autonomously processes the account creation, retrieves appropriate permission rules, and configures the user account without requiring any manual administrator intervention, thus eliminating both the complexity and time delay of manual approval processes
3Reliability
If manual administrator approval is required for user provisioning, then security and control are improved, but the provisioning process becomes complicated and causes delays
Solution Approach 1:
The system implements automated feedback loops where user attributes are automatically retrieved from the organization's directory service, permission rules are automatically applied based on these attributes, and account provisioning is automatically completed. This closed-loop automated process maintains security and control through systematic rule-based decisions while eliminating the complexity and delays associated with manual administrator approval
Data Source
AI summary
A method of provisioning organization users in a multi-tenant database system includes receiving a request via a single sign-on protocol from an organization user to create a new multi-tenant database user account for access to the multi-tenant database system. The method retrieves rules that specify how to derive user permissions for access to the multi-tenant database system from stored user attributes of the organization user. The method continues with applying the rules to the stored user attributes to determine permissions for the users to access particular objects in the multi-tenant database system, and creating the new user account with the determined user permissions for access to the multi-tenant database system.