Click here to close now.

Welcome!

Microservices Journal Authors: Jason Bloomberg, Pat Romanski, Elizabeth White, Liz McMillan, Srinivasan Sundara Rajan

Related Topics: Java, Microservices Journal

Java: Article

Access Control in Multi-Tenant Applications

Defining "Who sees what" and "who does what" are the two important aspects of access control in any software application

Defining "Who sees what" and "who does what" are the two important aspects of access control in any software application.

"Security" is a much larger subject, but this article focuses on just the access control aspects of security in a software application.

The Older Paradigm: Roles and Page-Level Access Controls
When you build a custom application for a specific customer, the access control policies of the organization are often defined upfront as part of the requirements phase. Depending on the vertical, domain and the specific organizational structure of the business, first the roles are defined. And then each role is given access to a set of screens, forms, pages and reports. What role A sees might be different from what role B sees. What role A can do could be different from what role B is allowed to do. Of course, certain areas in the application can be accessed by multiple roles. While building software products (used by several customers), the roles are often generalized and predefined. The various access control policies of the product are often hard coded in to the roles. The customer will be able to assign one or more roles to their users.

The New Paradigm: Privilege-Based Access Controls
In the new paradigm, before doing any action (including showing something on the screen - which is the View action), you check / demand for the privilege to view that information or do a certain action. It could be standard actions such as view, edit and delete or special privileges such as "Access to History Data" or "Access to information or content created by people other than myself. In the new paradigm, a user / roles privileges are resolved during run time - not hard coded at design time. This allows the product developer to complete the development just by demanding the necessary privileges at each step, without having to worry about the users and roles in the system.

Mapping Privileges to Roles
By enumerating the various privileges (entity wise or form wise standard privileges as well as special privileges) in an administration screen, we can allow the end customer to map the privileges to any specific role, during run time. This takes care of dynamic changes in organizational policy. This also allows the end customer to create completely new roles (not originally envisaged by the product designer) dynamically during actual usage and map a set of privileges to these new roles using an admin screen.
For example in a HR product, the product might have default roles such as "Employee" and "Manager" whereas a customer may create a new role called "Team Leader" or "Mentor."

Subsequently, users can be assigned with one or more roles (including new custom roles). So when a user is using the system, the application can resolve who the user is, what his or her role is, what the privileges of the role are - all during run time. So before a particular action, the application can simply check whether the required privilege is available for the user and proceed. While this may seem little challenging from the software design/development front, it will bring in lot of flexibility for the customers.

Relationship-Based Privileges
Many a time, mapping privileges to roles and assigning roles to users is also not adequate. Let's illustrate this with an example:

[email protected] has logged in to a performance management product. She has been assigned the role of a "Manager" and a set of Privileges have been assigned to this role. For example she can add certain new skills in the skills master, which another user with an "Employee" role cannot do.

But the real challenge however is in defining what she can and cannot see and what she can and cannot do with respect to the performance appraisal ratings of various employees.

Out of the 300 people in the organization, userX, is a "Primary Manager" for 4 employees, "Co-Manager for 5 employees", "Mentor" for 5 employees, "Department Head for 40 employees", and "Peer" for 15 employees. She is not related to the rest of the employees in the organization (in the context of performance management).

The privileges of what each of these "Relationships" can and cannot do is different. For example, a Mentor can view performance ratings but cannot edit them. A Primary Manager can edit ratings, but cannot approve them. And a Department head can approve/disapprove ratings, but cannot edit them.

How can we allow userX to login in once, view all the employees related to her in a single grid, but restrict her access depending on the relationship between her and the employee on whom she is performing the action?

  • Step 1: Define relationships in a master: This could be added / edited by the end customer.
  • Step 2: Map each privilege to a set of relationships who are to be given this privilege.
  • Step 3: Resolve the relationship between the user and the employee during run time and accordingly deduce whether the user has or does not have the privilege to do an action.

Static Data Scope
Apart from defining what a role can or cannot do / see, we often also want to restrict the boundaries of the data that the user has access to. For example, "Can edit employee profile information - but - only for people in his division / department", "Can see salary details - but only for employees reporting to her or to her down the line reports". Another example is to say that the Sales manager can access leads / customers only from his territory.

These datascopes should not be hard coded in the product, but should be configurable by an end customer. For each role and privilege mapping, the data scope can also be mapped.

The meanings of these datascopes are defined as "Meta data" which are nothing but Filter conditions. These filter conditions should be dynamically applied on the data set being accessed during run time, depending on the role-privilege-data scope resolved for the user context.

Dynamic Data Scope
This is an extended form of data scope, where the variable being defined for the data scope is itself defined dynamically.

For example, an "HR Administrator" role assigned to "User A" should administer for employees in "Location, P, Q and R" and "HR Administrator" role assigned to "User B" should administer for employees in "Location S, T and V" - where the location itself is user defined by the end customer in a Location Master.

Or Finance Manager should be able see the books of Divisions "A, B, C and D" where the Divisions itself is user defined by the end customer in a Division master.

Multi-Tenant Access Control
When the roles, relationships, privileges, static and dynamic data scopes are user definable by the end customer, and when the sample application serves multiple customers / tenants (from a single instance of the application), then we need to store all these access control configurations - tenant wise. So during run time, we should not only resolve the data scopes-privileges-roles-users, but also apply the tenant context and look up the appropriate tenant specific access control settings, before deciding to allow or disallow a particular action in the application.

Privilege mapping should be possible at the field Level, entity Level, form Level and page Level, so that the end customer / tenant has absolute control and flexibility in defining and modifying "Who sees what" and "Who can do what" in the system.

Tying in Subscription/ License Control with Access Control
Different tenants/ customers/ user groups should be given access or denied access to different modules and features in the product. This depends on the package that they have bought (in a SaaS product) or based on the Organizational Policy (in a Private/ Internal SaaS product).

These modules and features have to be first defined as Meta data and the corresponding page level access controls have to be mapped to them. This will allow the product to hide or show certain menu items and links to users depending on the tenant context and the packages enabled for that tenant/ user group.

Usage-Based Quota and Access Control
Many a times tenants are allowed to use the product for a specific no. of users or for a specified quota of usage (For example can do XXX no. of market surveys). These transactions and events have to be metered in the product, and once the defined quota is exceeded, the access control system should deny access to any user belonging to that tenant / user group.

Summary
The Access Control Paradigm of a Multi-tenant Application/ SaaS Product, should enlarge its frame of reference to include extensive customizability and configurability to suit different customers and organizations while still maintaining a single instance and code base.

The engineering stack of a Multi - tenant SaaS product, should have a robust and flexible Access Control layer, so that all the dynamic and run time capabilities are handled at the framework level. The developer then can focus on building the business functions, follow the guidelines provided by the underlying framework and demand a privilege before doing any significant action.

More Stories By Sathiya Rajendhran

Ramkumar is the Founder and Director of Mango DVM, a venture capital funded company in the digital music space, currently going through a third round of funding. He is also the Director of Product Management at Asteor Software Inc, where he was instrumental in incubating and bringing to market two new software products (Techcello & Synergita). He is also the Director of RSR Innovations, a consultancy firm specializing on Strategic Marketing, Innovation and Leadership Development.

Before becoming an entrepreneur, Ramkumar had spent over two decades in various corporates; in functions such as Automation Engineering, Project management, Product management, Marketing and General management.

@MicroservicesExpo Stories
Dave will share his insights on how Internet of Things for Enterprises are transforming and making more productive and efficient operations and maintenance (O&M) procedures in the cleantech industry and beyond. Speaker Bio: Dave Landa is chief operating officer of Cybozu Corp (kintone US). Based in the San Francisco Bay Area, Dave has been on the forefront of the Cloud revolution driving strategic business development on the executive teams of multiple leading Software as a Services (SaaS) ap...
The 5th International DevOps Summit, co-located with 17th International Cloud Expo – being held November 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA – announces that its Call for Papers is open. Born out of proven success in agile development, cloud computing, and process automation, DevOps is a macro trend you cannot afford to miss. From showcase success stories from early adopters and web-scale businesses, DevOps is expanding to organizations of all sizes, including the...
Thought experiment: let’s say your app gets a message from somewhere, perhaps from another app, but you don’t know from where. The message contains the number 47 but no other information. What should your app do with the message? The answer: nothing. There’s no way for your app to make any sense out of a single datum with no context, no additional information or metadata about the datum itself. Now, let’s scale up this thought experiment to a data lake. There are a few common definitions o...
What exactly is a cognitive application? In her session at 16th Cloud Expo, Ashley Hathaway, Product Manager at IBM Watson, will look at the services being offered by the IBM Watson Developer Cloud and what that means for developers and Big Data. She'll explore how IBM Watson and its partnerships will continue to grow and help define what it means to be a cognitive service, as well as take a look at the offerings on Bluemix. She will also check out how Watson and the Alchemy API team up to off...
The 17th International Cloud Expo has announced that its Call for Papers is open. 17th International Cloud Expo, to be held November 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA, brings together Cloud Computing, APM, APIs, Microservices, Security, Big Data, Internet of Things, DevOps and WebRTC to one location. With cloud computing driving a higher percentage of enterprise IT budgets every year, it becomes increasingly important to plant your flag in this fast-expanding bu...
How do you securely enable access to your applications in AWS without exposing any attack surfaces? The answer is usually very complicated because application environments morph over time in response to growing requirements from your employee base, your partners and your customers. In his session at 16th Cloud Expo, Haseeb Budhani, CEO and Co-founder of Soha, will share five common approaches that DevOps teams follow to secure access to applications deployed in AWS, Azure, etc., and the frict...
The concept and subsequent adoption of 'Containerization'' is growing at a rapid speed with the support of almost every other major player in the industry. This concept is much more efficient than the Virtualization which has been a major option for Infrastructure optimization in the past decade. The following factors distinguish a Container from a Virtual Machine. Containers contain Only the Application Specific libraries and binaries. They do not include a guest operating system. Rather ...
Back in 2009 I posted about the “Great Cloud Shakeout” and the coming market consolidation into a few very large clouds. Nearly 5 1/2 years later and it’s about (long past?) time I took another look to see how I did. Back then I predicted that the market would be dominated by “mega CSPs” by the name of Amazon, Google and Microsoft. Note that this was during a period of Cambrian Explosion in the CSP market – it seems like everybody in the hosting business wanted to be a cloud provider....
As we recently previewed (read more about our London PoP in Jesse's post), Blue Box is opening a new Data Center in London, but hadn't announced the provider. Today we're excited to partner with TelecityGroup, whom we've selected as our data center partner in London. We chose their Powergate location, which is one of the U.K.'s most advanced, flexible and energy efficient carrier-neutral data centres. Why does that matter to you? Well, when customers choose Blue Box, they're trusting us with ...
SYS-CON Events announced today that Column Technologies, a global technology solutions company, will exhibit at SYS-CON's DevOps Summit 2015 New York, which will take place June 9-11, 2015, at the Javits Center in New York City, NY. Established in 1998, Column Technologies is a leader in application performance and infrastructure management for commercial and federal markets. The company is headquartered in the United States, with a diverse and talented team of more than 350 employees around th...
Cloud Expo New York is happening from June 9 - 11. This event brings together the worlds of Cloud Computing, DevOps, IoT, WebRTC, Big Data and SDDC. We hope to see you there-members of the Blue Box team will exhibit in booth 218 next to the DevOps area. Plus, our Chief Product Officer, Hernan Alvarez, will present his talk "The Cloud Has a Down-and-Dirty Lining" as part of the Operations track in the DevOps Summit portion of the event on June 9 at 11 am. Learn more about his session her...
Financial services organizations were among the earliest enterprise adopters of cloud computing. The ability to leverage massive compute, storage and networking resources via RESTful APIs and automated tools like Chef and Puppet made it possible for their high-horsepower IT users to develop a whole new array of applications. Companies like Wells Fargo, Fidelity and BBVA are visible, vocal and engaged supporters of the OpenStack community, running production clouds for applications ranging from d...
ProfitBricks has launched its new DevOps Central and REST API, along with support for three multi-cloud libraries and a Python SDK. This, combined with its already existing SOAP API and its new RESTful API, moves ProfitBricks into a position to better serve the DevOps community and provide the ability to automate cloud infrastructure in a multi-cloud world. Following this momentum, ProfitBricks has also introduced several libraries that enable developers to use their favorite language to code ...
SYS-CON Events announced today Sematext Group, Inc., a Brooklyn-based Performance Monitoring and Log Management solution provider, will exhibit at SYS-CON's DevOps Summit 2015 New York, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. Sematext is a globally distributed organization that builds innovative Cloud and On Premises solutions for performance monitoring, alerting and anomaly detection (SPM), log management and analytics (Logsene), search analytics (S...
SYS-CON Events announced today Isomorphic Software, the global leader in high-end, web-based business applications, will exhibit at SYS-CON's DevOps Summit 2015 New York, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. Isomorphic Software is the global leader in high-end, web-based business applications. We develop, market, and support the SmartClient & Smart GWT HTML5/Ajax platform, combining the productivity and performance of traditional desktop software ...
SYS-CON Events announced today that Cisco, the worldwide leader in IT that transforms how people connect, communicate and collaborate, has been named “Gold Sponsor” of SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. Cisco makes amazing things happen by connecting the unconnected. Cisco has shaped the future of the Internet by becoming the worldwide leader in transforming how people connect, communicate and collaborat...
We just finished the first O’Reilly Software Architecture Conference and the overwhelming most popular topic was microservices. Why all the hype about an architectural style? Microservices are the first post-DevOps revolution architecture. The DevOps revolution highlighted how much inadvertent friction an outdated operations mindset can cause, starting the move towards automating away manual tasks.
SYS-CON Events announced today that Ciqada will exhibit at SYS-CON's @ThingsExpo, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. Ciqada™ makes it easy to connect your products to the Internet. By integrating key components - hardware, servers, dashboards, and mobile apps - into an easy-to-use, configurable system, your products can quickly and securely join the internet of things. With remote monitoring, control, and alert messaging capability, you will mee...
SYS-CON Media announced today that Blue Box as launched a popular blog feed on Cloud Computing Journal. Cloud Computing Journal aims to help open the eyes of Enterprise IT professionals to the economics and strategies that utility/cloud computing provides. Blue Box Cloud gives you unequaled agility, without the burden of designing, deploying and managing your own infrastructure. It’s the right choice when public cloud just won’t do. Blue Box Cloud is a managed Private Cloud as a Service (...
SYS-CON Events announced today that ProfitBricks, the provider of painless cloud infrastructure, will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY., and the 17th International Cloud Expo®, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. ProfitBricks is the IaaS provider that offers a painless cloud experience for all IT users, with no learning curve. ...