Welcome!

Microservices Expo Authors: Pat Romanski, Elizabeth White, Yeshim Deniz, Kevin Jackson, ManageEngine IT Matters

Related Topics: Java IoT, Microservices Expo

Java IoT: Article

Access Control in Multi-Tenant Applications

Defining "Who sees what" and "who does what" are the two important aspects of access control in any software application

Defining "Who sees what" and "who does what" are the two important aspects of access control in any software application.

"Security" is a much larger subject, but this article focuses on just the access control aspects of security in a software application.

The Older Paradigm: Roles and Page-Level Access Controls
When you build a custom application for a specific customer, the access control policies of the organization are often defined upfront as part of the requirements phase. Depending on the vertical, domain and the specific organizational structure of the business, first the roles are defined. And then each role is given access to a set of screens, forms, pages and reports. What role A sees might be different from what role B sees. What role A can do could be different from what role B is allowed to do. Of course, certain areas in the application can be accessed by multiple roles. While building software products (used by several customers), the roles are often generalized and predefined. The various access control policies of the product are often hard coded in to the roles. The customer will be able to assign one or more roles to their users.

The New Paradigm: Privilege-Based Access Controls
In the new paradigm, before doing any action (including showing something on the screen - which is the View action), you check / demand for the privilege to view that information or do a certain action. It could be standard actions such as view, edit and delete or special privileges such as "Access to History Data" or "Access to information or content created by people other than myself. In the new paradigm, a user / roles privileges are resolved during run time - not hard coded at design time. This allows the product developer to complete the development just by demanding the necessary privileges at each step, without having to worry about the users and roles in the system.

Mapping Privileges to Roles
By enumerating the various privileges (entity wise or form wise standard privileges as well as special privileges) in an administration screen, we can allow the end customer to map the privileges to any specific role, during run time. This takes care of dynamic changes in organizational policy. This also allows the end customer to create completely new roles (not originally envisaged by the product designer) dynamically during actual usage and map a set of privileges to these new roles using an admin screen.
For example in a HR product, the product might have default roles such as "Employee" and "Manager" whereas a customer may create a new role called "Team Leader" or "Mentor."

Subsequently, users can be assigned with one or more roles (including new custom roles). So when a user is using the system, the application can resolve who the user is, what his or her role is, what the privileges of the role are - all during run time. So before a particular action, the application can simply check whether the required privilege is available for the user and proceed. While this may seem little challenging from the software design/development front, it will bring in lot of flexibility for the customers.

Relationship-Based Privileges
Many a time, mapping privileges to roles and assigning roles to users is also not adequate. Let's illustrate this with an example:

[email protected] has logged in to a performance management product. She has been assigned the role of a "Manager" and a set of Privileges have been assigned to this role. For example she can add certain new skills in the skills master, which another user with an "Employee" role cannot do.

But the real challenge however is in defining what she can and cannot see and what she can and cannot do with respect to the performance appraisal ratings of various employees.

Out of the 300 people in the organization, userX, is a "Primary Manager" for 4 employees, "Co-Manager for 5 employees", "Mentor" for 5 employees, "Department Head for 40 employees", and "Peer" for 15 employees. She is not related to the rest of the employees in the organization (in the context of performance management).

The privileges of what each of these "Relationships" can and cannot do is different. For example, a Mentor can view performance ratings but cannot edit them. A Primary Manager can edit ratings, but cannot approve them. And a Department head can approve/disapprove ratings, but cannot edit them.

How can we allow userX to login in once, view all the employees related to her in a single grid, but restrict her access depending on the relationship between her and the employee on whom she is performing the action?

  • Step 1: Define relationships in a master: This could be added / edited by the end customer.
  • Step 2: Map each privilege to a set of relationships who are to be given this privilege.
  • Step 3: Resolve the relationship between the user and the employee during run time and accordingly deduce whether the user has or does not have the privilege to do an action.

Static Data Scope
Apart from defining what a role can or cannot do / see, we often also want to restrict the boundaries of the data that the user has access to. For example, "Can edit employee profile information - but - only for people in his division / department", "Can see salary details - but only for employees reporting to her or to her down the line reports". Another example is to say that the Sales manager can access leads / customers only from his territory.

These datascopes should not be hard coded in the product, but should be configurable by an end customer. For each role and privilege mapping, the data scope can also be mapped.

The meanings of these datascopes are defined as "Meta data" which are nothing but Filter conditions. These filter conditions should be dynamically applied on the data set being accessed during run time, depending on the role-privilege-data scope resolved for the user context.

Dynamic Data Scope
This is an extended form of data scope, where the variable being defined for the data scope is itself defined dynamically.

For example, an "HR Administrator" role assigned to "User A" should administer for employees in "Location, P, Q and R" and "HR Administrator" role assigned to "User B" should administer for employees in "Location S, T and V" - where the location itself is user defined by the end customer in a Location Master.

Or Finance Manager should be able see the books of Divisions "A, B, C and D" where the Divisions itself is user defined by the end customer in a Division master.

Multi-Tenant Access Control
When the roles, relationships, privileges, static and dynamic data scopes are user definable by the end customer, and when the sample application serves multiple customers / tenants (from a single instance of the application), then we need to store all these access control configurations - tenant wise. So during run time, we should not only resolve the data scopes-privileges-roles-users, but also apply the tenant context and look up the appropriate tenant specific access control settings, before deciding to allow or disallow a particular action in the application.

Privilege mapping should be possible at the field Level, entity Level, form Level and page Level, so that the end customer / tenant has absolute control and flexibility in defining and modifying "Who sees what" and "Who can do what" in the system.

Tying in Subscription/ License Control with Access Control
Different tenants/ customers/ user groups should be given access or denied access to different modules and features in the product. This depends on the package that they have bought (in a SaaS product) or based on the Organizational Policy (in a Private/ Internal SaaS product).

These modules and features have to be first defined as Meta data and the corresponding page level access controls have to be mapped to them. This will allow the product to hide or show certain menu items and links to users depending on the tenant context and the packages enabled for that tenant/ user group.

Usage-Based Quota and Access Control
Many a times tenants are allowed to use the product for a specific no. of users or for a specified quota of usage (For example can do XXX no. of market surveys). These transactions and events have to be metered in the product, and once the defined quota is exceeded, the access control system should deny access to any user belonging to that tenant / user group.

Summary
The Access Control Paradigm of a Multi-tenant Application/ SaaS Product, should enlarge its frame of reference to include extensive customizability and configurability to suit different customers and organizations while still maintaining a single instance and code base.

The engineering stack of a Multi - tenant SaaS product, should have a robust and flexible Access Control layer, so that all the dynamic and run time capabilities are handled at the framework level. The developer then can focus on building the business functions, follow the guidelines provided by the underlying framework and demand a privilege before doing any significant action.

More Stories By Sathiya Rajendhran

Ramkumar is the Founder and Director of Mango DVM, a venture capital funded company in the digital music space, currently going through a third round of funding. He is also the Director of Product Management at Asteor Software Inc, where he was instrumental in incubating and bringing to market two new software products (Techcello & Synergita). He is also the Director of RSR Innovations, a consultancy firm specializing on Strategic Marketing, Innovation and Leadership Development.

Before becoming an entrepreneur, Ramkumar had spent over two decades in various corporates; in functions such as Automation Engineering, Project management, Product management, Marketing and General management.

@MicroservicesExpo Stories
What's the role of an IT self-service portal when you get to continuous delivery and Infrastructure as Code? This general session showed how to create the continuous delivery culture and eight accelerators for leading the change. Don Demcsak is a DevOps and Cloud Native Modernization Principal for Dell EMC based out of New Jersey. He is a former, long time, Microsoft Most Valuable Professional, specializing in building and architecting Application Delivery Pipelines for hybrid legacy, and cloud ...
21st International Cloud Expo, taking place October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA, will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud strategy. Me...
"Tintri focuses on the Ops side of the DevOps, which basically is pushing more and more of the accessibility of the infrastructure to the developers and trying to get behind the scenes," explained Dhiraj Sehgal of Tintri in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
"We do one of the best file systems in the world. We learned how to deal with Big Data many years ago and we implemented this knowledge into our software," explained Jakub Ratajczak, Business Development Manager at MooseFS, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
SYS-CON Events announced today that CA Technologies has been named "Platinum Sponsor" of SYS-CON's 21st International Cloud Expo®, which will take place October 31-November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. CA Technologies helps customers succeed in a future where every business - from apparel to energy - is being rewritten by software. From planning to development to management to security, CA creates software that fuels transformation for companies in the applic...
Five years ago development was seen as a dead-end career, now it’s anything but – with an explosion in mobile and IoT initiatives increasing the demand for skilled engineers. But apart from having a ready supply of great coders, what constitutes true ‘DevOps Royalty’? It’ll be the ability to craft resilient architectures, supportability, security everywhere across the software lifecycle. In his keynote at @DevOpsSummit at 20th Cloud Expo, Jeffrey Scheaffer, GM and SVP, Continuous Delivery Busine...
Cloud Expo, Inc. has announced today that Andi Mann and Aruna Ravichandran have been named Co-Chairs of @DevOpsSummit at Cloud Expo Silicon Valley which will take place Oct. 31-Nov. 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. "DevOps is at the intersection of technology and business-optimizing tools, organizations and processes to bring measurable improvements in productivity and profitability," said Aruna Ravichandran, vice president, DevOps product and solutions marketing...
You know you need the cloud, but you’re hesitant to simply dump everything at Amazon since you know that not all workloads are suitable for cloud. You know that you want the kind of ease of use and scalability that you get with public cloud, but your applications are architected in a way that makes the public cloud a non-starter. You’re looking at private cloud solutions based on hyperconverged infrastructure, but you’re concerned with the limits inherent in those technologies.
Managing mission-critical SAP systems and landscapes has never been easy. Add public cloud with its myriad of powerful cloud native services and this may not change any time soon. Public cloud offers exciting new possibilities for enterprise workloads. But to make use of these possibilities and capabilities, IT teams need to re-think everything they have done before. Otherwise, they will just end up using public cloud as a hosting platform for their workloads, aka known as “lift and shift.”
There's a lot to gain from cloud computing, but success requires a thoughtful and enterprise focused approach. Cloud computing decouples data and information from the infrastructure on which it lies. A process that is a LOT more involved than dragging some folders from your desktop to a shared drive. Cloud computing as a mission transformation activity, not a technological one. As an organization moves from local information hosting to the cloud, one of the most important challenges is addressi...
The reality of data ubiquity is here—data is buried in operational statistics, machine logs, stacks of overflowing tickets and customer details, among other things. How can any user get valuable information amid this rapid influx of data? Imagine a situation where your firm’s revenue takes a hit owing to an unexpected failure in some business process. It would be a nightmare for IT admins to sift through the interminable piles of data to deduce exactly why and where the problem occurred. To sav...
Hybrid IT is today’s reality, and while its implementation may seem daunting at times, more and more organizations are migrating to the cloud. In fact, according to SolarWinds 2017 IT Trends Index: Portrait of a Hybrid IT Organization 95 percent of organizations have migrated crucial applications to the cloud in the past year. As such, it’s in every IT professional’s best interest to know what to expect.
Both SaaS vendors and SaaS buyers are going “all-in” to hyperscale IaaS platforms such as AWS, which is disrupting the SaaS value proposition. Why should the enterprise SaaS consumer pay for the SaaS service if their data is resident in adjacent AWS S3 buckets? If both SaaS sellers and buyers are using the same cloud tools, automation and pay-per-transaction model offered by IaaS platforms, then why not host the “shrink-wrapped” software in the customers’ cloud? Further, serverless computing, cl...
In the decade following his article, cloud computing further cemented Carr’s perspective. Compute, storage, and network resources have become simple utilities, available at the proverbial turn of the faucet. The value they provide is immense, but the cloud playing field is amazingly level. Carr’s quote above presaged the cloud to a T. Today, however, we’re in the digital era. Mark Andreesen’s ‘software is eating the world’ prognostication is coming to pass, as enterprises realize they must be...
A common misconception about the cloud is that one size fits all. Companies expecting to run all of their operations using one cloud solution or service must realize that doing so is akin to forcing the totality of their business functionality into a straightjacket. Unlocking the full potential of the cloud means embracing the multi-cloud future where businesses use their own cloud, and/or clouds from different vendors, to support separate functions or product groups. There is no single cloud so...
In 2014, Amazon announced a new form of compute called Lambda. We didn't know it at the time, but this represented a fundamental shift in what we expect from cloud computing. Now, all of the major cloud computing vendors want to take part in this disruptive technology. In his session at 20th Cloud Expo, Doug Vanderweide, an instructor at Linux Academy, discussed why major players like AWS, Microsoft Azure, IBM Bluemix, and Google Cloud Platform are all trying to sidestep VMs and containers wit...
Companies have always been concerned that traditional enterprise software is slow and complex to install, often disrupting critical and time-sensitive operations during roll-out. With the growing need to integrate new digital technologies into the enterprise to transform business processes, this concern has become even more pressing. A 2016 Panorama Consulting Solutions study revealed that enterprise resource planning (ERP) projects took an average of 21 months to install, with 57 percent of th...
New competitors, disruptive technologies, and growing expectations are pushing every business to both adopt and deliver new digital services. This ‘Digital Transformation’ demands rapid delivery and continuous iteration of new competitive services via multiple channels, which in turn demands new service delivery techniques – including DevOps. In this power panel at @DevOpsSummit 20th Cloud Expo, moderated by DevOps Conference Co-Chair Andi Mann, panelists examined how DevOps helps to meet the de...
The taxi industry never saw Uber coming. Startups are a threat to incumbents like never before, and a major enabler for startups is that they are instantly “cloud ready.” If innovation moves at the pace of IT, then your company is in trouble. Why? Because your data center will not keep up with frenetic pace AWS, Microsoft and Google are rolling out new capabilities. In his session at 20th Cloud Expo, Don Browning, VP of Cloud Architecture at Turner, posited that disruption is inevitable for comp...
"When we talk about cloud without compromise what we're talking about is that when people think about 'I need the flexibility of the cloud' - it's the ability to create applications and run them in a cloud environment that's far more flexible,” explained Matthew Finnie, CTO of Interoute, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.