US 12,143,387 B2
Dynamic authorization in a multi-tenancy environment via tenant policy profiles
Michael G. Roche, Hamilton (CA); and Michal J. Drozd, Cracow (PL)
Assigned to EMC IP Holding Company LLC, Hopkinton, MA (US)
Filed by EMC IP Holding Company LLC, Hopkinton, MA (US)
Filed on Jan. 15, 2020, as Appl. No. 16/743,567.
Application 16/743,567 is a continuation of application No. 15/216,193, filed on Jul. 21, 2016, granted, now 10,659,495.
Application 15/216,193 is a continuation of application No. 14/510,737, filed on Oct. 9, 2014, granted, now 9,432,379, issued on Aug. 30, 2016.
Prior Publication US 2020/0153870 A1, May 14, 2020
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/102 (2013.01) [H04L 63/08 (2013.01); H04L 63/10 (2013.01); H04L 63/20 (2013.01)] 12 Claims
OG exemplary drawing
 
1. A method, comprising:
managing user access to an application hosted by a computing system, by performing operations comprising:
receiving at the application, a token from an authentication component of an authorization/authentication service, which includes the authentication component and an authorization component,
wherein the token includes an application role and a privilege mask associated with the application role,
wherein the application role corresponds to a role of an entity with respect to the application, and the privilege mask defines one or more privileges, which can be granted to the entity with respect to the application upon authentication of the entity based on the role of the entity, and
wherein the token is generated by the authentication component based on the application role and the privilege mask, which has been generated by the authorization component in response to a set of characteristics sent by the authentication component to the authorization component;
receiving at the application, by way of the authorization/authentication service with which the application is in communication, an authentication request from the entity seeking access to the application;
identifying a change in the computing system;
based on the change, receiving an updated token at the application from the authorization/authentication service;
evaluating the authentication request based on the updated token;
approving the authentication request when information in the authentication request matches the updated token;
granting, to the entity, access to the application when the authentication request has been approved, wherein granting the entity access to the application comprises enabling the entity to access and run one or more functions of the application based on the privilege mask; and
denying access to the application when the information in the authentication request does not match the updated token and notifying the user the authentication request has been denied,
wherein the approving, granting, and denying processes are performed by the application to which the entity is seeking access, and
wherein, when the entity or a different entity seeks access to another application, user access to the another application is controlled by the another application.