Multi-tenant Sidecar for Application Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Many applications do not support multi-tenancy access, preventing clients from providing their clients with access to these applications via different roles or permission management.
Innovation Solution
A multi-tenant sidecar application is created that allows entities to create contexts for each tenant, onboard users, assign users to contexts, and define roles and permissions. An API is exposed to onboarded applications to retrieve user details, contexts, and roles, enabling configured access based on authentication through an identity provider.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If applications provide client-by-client access on a separate entity basis, then application access control is simple and secure, but multi-tenancy access and role-based permission management are not supported
Solution Approach 1:
The patent introduces a sidecar application as an intermediary layer between the identity provider and the target application. This sidecar application handles multi-tenancy logic, user context management, and role-based access control, allowing the original application to remain simple while gaining multi-tenancy capabilities through the mediating sidecar component.
Solution Approach 2:
The access management functionality is segmented into separate components: the identity provider handles authentication, the sidecar application handles multi-tenancy and role management, and the target application handles core business logic. This segmentation allows each component to be optimized independently and enables multi-tenancy without redesigning the entire application stack.
2Adaptability or versatility
If clients want to provide access to their clients through different roles or permission management, then access control flexibility is improved, but the application architecture becomes more complex
Solution Approach 1:
The sidecar application serves as an intermediary that introduces role-based permission management between the identity provider and the target application. It manages user contexts, assigns roles, and controls access without requiring changes to the target application's core architecture, thus maintaining flexibility while minimizing architectural complexity.
Solution Approach 2:
The sidecar application provides universal access control functionality that works across multiple applications and tenant scenarios. It handles authentication, authorization, role management, and context switching through a single unified system, reducing the need for separate access control mechanisms in each application.
3Adaptability or versatility
If an API is exposed to allow application retrieval of user details and contexts, then multi-tenancy access is enabled, but authentication and security requirements increase
Solution Approach 1:
The sidecar application acts as a secure intermediary that manages authentication and API access. It validates user credentials, manages session tokens, and controls which users can access which applications through the exposed API, thereby enabling multi-tenancy while maintaining strong security through centralized authentication management.
Data Source
AI summary
A multi-tenant sidecar application is created that allows entities to create contexts for each tenant, onboard users, assign users to contexts, and define roles and permissions for each user assigned to a context. When an application is onboarded into the sidecar application for an entity, an API is exposed to the application that allows it to receive details on the various users, contexts, and roles and permissions associated with the application. Only users who authenticate through an identity provider or an identity service provider may be allowed access to the API. Later, a user associated with the entity may use the sidecar application to log into an onboarded application and the application may retrieve the roles and contexts associated with the user for the entity using the API. The application may then be configured for the user according to the retrieved context and roles.