Multi-tenant authorization framework in a data management and storage cluster

A data management and storage (DMS) cluster, comprising:

• peer DMS nodes;
• and
• a distributed data store implemented across the peer DMS nodes, the distributed data store storing resources of a multi-tenant environment;
• wherein the peer DMS nodes are configured to collectively implement:
• determining user authorizations associated with the user, the user authorizations defining privileges of the user on the resources of the multi-tenant environment;
• determining an organization associated with the user;
• determining organization authorizations associated with the organization, the organization authorizations defining resources of the multi-tenant environment that belong to the organization;
• determining whether the user authorizations and the organization authorizations indicate that a first action by the user on the resource is authorized;
• responsive to determining that the first action by the user on the resource is authorized, executing the action on the resource, wherein the resource is a virtual machine, and executing the action on the resource includes capturing a first snapshot of the virtual machine;
• storing the first snap shot in a section of the distributed data store associated with a particular DMS node among the peer DMS nodes;
• assigning a second action to the particular DMS node among the peer DMS nodes, the second action including capturing a second snapshot of the virtual machine, and comparing the first and second snapshots;
• and
• decomposing the captured snapshots into images;
• and
• storing the images in a data structure in the distributed data store.

A non-transitory computer-readable medium comprising instructions that when executed by a processor configure the processor to implement a process comprising:

• determining user authorizations associated with the user, the user authorizations defining privileges of the user on resources of the multi-tenant environment;
• determining an organization associated with the user;
• determining organization authorizations associated with the organization, the organization authorizations defining resources of the multi-tenant environment that belong to the organization;
• determining whether the user authorizations and the organization authorizations indicate that a first action by the user on the resource is authorized;
• responsive to determining that the first action by the user on the resource is authorized, executing the action on the resource, wherein the resource is a virtual machine, and executing the action on the resource includes capturing a first snapshot of the virtual machine;
• storing the first snap shot in a section of the distributed data store associated with a particular DMS node among the peer DMS nodes;
• assigning a second action to the particular DMS node among the peer DMS nodes, the second action including capturing a second snapshot of the virtual machine, and comparing the first and second snapshots;
• and
• decomposing the captured snapshots into images;
• and
• storing the images in a data structure in the distributed data store.