Method and apparatus for federated identity and authentication services

An apparatus comprising:

• a processor;
• and
• memory storing instructions that, when executed on the processor, cause the apparatus to:
• receive, from an authentication server in a first domain, an assertion at an authentication service in a second domain, the assertion generated by the authentication server in the first domain according to a validated request from a client in the first domain, wherein the authentication server residing in the first domain generates the assertion in response to receiving credentials from the client;
• generate, at the authentication service in the second domain according to the assertion received from the first domain, a token configured to be redeemed by the client in the first domain to the authentication service for authentication by the authentication service in the second domain of the client in the first domain to enable the client in the first domain to access a resource in the second domain;
• and
• provide the token from the authentication service in the second domain to the authentication server in the first domain for provision to the client in the first domain and subsequent redemption by the client in the first domain to the authentication service for authentication by the authentication service in the second domain of the client in the first domain to enable the client in the first domain to access the resource in the second domain;
• wherein the first domain is associated with an enterprise system;
• wherein the second domain is associated with a multi-tenant cloud computing system;
• and
• wherein the token comprises a set of attributes of a tenant client in the multi-tenant cloud computing system, the set of attributes comprising one or more privilege assignments for utilizing (i) one or more portions of an object storage pool managed by a system administrator tenant and (ii) one or more additional storage pools from which the tenant client is permitted to provision block and file storage.

A computer program product including anon-transitory computer-readable storage medium encoded with computer program code that, when executed on a processor of a computer, causes the computer to authenticate a request from a first domain to access a resource in a second domain according to credentials in the first domain, the computer program product comprising:

• computer program code for receiving, from an authentication server in a first domain, an assertion at an authentication service in a second domain, the assertion generated by the authentication server in the first domain according to a validated request from a client in the first domain, wherein the authentication server residing in the first domain generates the assertion in response to receiving credentials from the client;
• computer program code for generating, at the authentication service in the second domain according to the assertion received from the first domain, a token configured to be redeemed by the client in the first domain to the authentication service for authentication by the authentication service in the second domain of the client in the first domain to enable the client in the first domain to access a resource in the second domain;
• and
• computer program code for providing the token from the authentication service in the second domain to the authentication server in the first domain for provision to the client in the first domain and subsequent redemption by the client in the first domain to the authentication service for authentication by the authentication service in the second domain of the client in the first domain to enable the client in the first domain to access the resource in the second domain;
• wherein the first domain is associated with an enterprise system;
• wherein the second domain is associated with a multi-tenant cloud computing system;
• and
• wherein the token comprises a set of attributes of a tenant client in the multi-tenant cloud computing system, the set of attributes comprising one or more privilege assignments for utilizing (i) one or more portions of an object storage pool managed by a system administrator tenant and (ii) one or more additional storage pools from which the tenant client is permitted to provision block and file storage.