System and method for single sign-on technical support access to tenant accounts and data in a multi-tenant platform

A system for single sign-on support access to tenant systems on a multi-tenant service platform, the system including:

• at least one hardware processor;
• an identity provider module with a plurality of proxy user account identifiers, each proxy user account identifier of the plurality of proxy user account identifiers configured to assist in identifying a proxy user account configured to assist in accessing a respective tenant system of a plurality of tenant systems on a multi-tenant service platform, each proxy user account identifier of the plurality of proxy user account identifiers having corresponding security metadata associated therewith in the identity provider module, the corresponding security metadata configured to enable a corresponding proxy user account to access a corresponding respective tenant system, a particular proxy user account identifier identifying a particular proxy user account of the plurality of proxy user accounts that is configured to assist in accessing a particular tenant system of the plurality of tenant systems, the particular proxy user account of the plurality of proxy user accounts being dynamically created and configured after one or more first trigger events, the one or more first trigger events including the addition of the particular tenant system of the plurality of tenant systems to the multi-tenant service platform;
• mappings in the identity provider module that map a plurality of support user accounts to the plurality of proxy user account identifiers, at least one first particular mapping of the mappings in the identity provider module mapping a first particular support user account of the plurality of support user accounts to the particular proxy user account identifier, the at least one first particular mapping of the mappings being dynamically mapped in the identity provider module after the one or more first trigger events, at least one second particular mapping of the mappings in the identity provider module mapping a second particular support user account of the plurality of support user accounts to a subset of the plurality of proxy user account identifiers, the subset of the plurality of proxy user account identifiers including the particular proxy user account identifier and including less than all of the proxy user account identifiers;
• a security endpoint module in the multi-tenant service platform, the security endpoint module configured to assist in connecting each proxy user account of the plurality of proxy user accounts to the respective tenant system of the plurality of tenant systems, the security endpoint module including a mapping that maps each proxy user account of the plurality of proxy user accounts to the respective tenant system of the plurality of tenant systems;
• wherein the identity provider module is configured to:
• receive from the second particular support user account a request to access the particular tenant system,
• authenticate a second particular support user of the second particular support user account,
• confirm that the second particular support user account is authorized to access the particular tenant system by confirming that the second particular support user account is mapped to a particular tenant system identifier associated with the particular tenant system, and
• if the second particular support user is authenticated and authorized, send a security assertion with the particular proxy user account identifier and the corresponding security metadata to the security endpoint module in response to the request;
• and
• wherein the security endpoint module is configured to:
• receive the security assertion, the particular proxy user account identifier, and the corresponding security metadata for the second particular support user,
• use the particular proxy user account identifier to identify the particular proxy user account,
• use the particular proxy user account and the corresponding security metadata to enable the second particular support user to access the particular tenant system of the plurality of tenant systems without disclosing the corresponding security metadata to the second particular support user, and without allowing the second particular support user to access other tenant systems of the plurality of tenant systems in response to the request, and
• remove at least a portion of the mappings in the identity provider module, the at least a portion of the mappings corresponding to the second particular support user account, the at least a portion of the mappings being dynamically removed after one or more second trigger events, the one or more second trigger events including deactivation of the second particular support user account.

Non-transitory computer readable storage storing computer code configured to cause one or more processing devices to operate to provide single sign-on support access to tenant systems on a multi-tenant service platform, the computer code including instructions that configure the one or more processing devices to:

• provide a plurality of proxy user account identifiers in an identity provider module, each proxy user account identifier of the plurality of proxy user account identifiers configured to assist in identifying a proxy user account configured to assist in accessing a respective tenant system of a plurality of tenant systems on a multi-tenant service platform, each proxy user account identifier of the plurality of proxy user account identifiers having corresponding security metadata associated therewith in the identity provider module, the corresponding security metadata configured to enable a corresponding proxy user account to access a corresponding respective tenant system, a particular proxy user account identifier identifying a particular proxy user account of the plurality of proxy user accounts that is configured to assist in accessing a particular tenant system of the plurality of tenant systems, the particular proxy user account of the plurality of proxy user accounts being dynamically created and configured after one or more first trigger events, the one or more first trigger events including the addition of the particular tenant system of the plurality of tenant systems to the multi-tenant service platform;
• provide mappings in the identity provider module that map a plurality of support user accounts to the plurality of proxy user account identifiers, at least one first particular mapping of the mappings in the identity provider module mapping a first particular support user account of the plurality of support user accounts to the particular proxy user account identifier, the at least one first particular mapping of the mappings being dynamically mapped in the identity provider module after the one or more first trigger events, at least one second particular mapping of the mappings in the identity provider module mapping a second particular support user account of the plurality of support user accounts to a subset of the plurality of proxy user account identifiers, the subset of the plurality of proxy user account identifiers including the particular proxy user account identifier and including less than all of the proxy user account identifiers;
• use a security endpoint module in the multi-tenant service platform to assist in connecting each proxy user account of the plurality of proxy user accounts to the respective tenant system of the plurality of tenant systems, the security endpoint module including a mapping that maps each proxy user account of the plurality of proxy user accounts to the respective tenant system of the plurality of tenant systems;
• in the identity provider module:
• receive from the second particular support user account a request to access the particular tenant system,
• authenticate a second particular support user of the second particular support user account,
• confirm that the second particular support user account is authorized to access the particular tenant system by confirming that the second particular support user account is mapped to a particular tenant system identifier associated with the particular tenant system, and
• if the second particular support user is authenticated and authorized, send a security assertion with the particular proxy user account identifier and the corresponding security metadata to the security endpoint module in response to the request;
• and
• in the security endpoint module:
• receive the security assertion, the particular proxy user account identifier, and the corresponding security metadata for the second particular support user,
• use the particular proxy user account identifier to identify the particular proxy user account,
• use the particular proxy user account and the corresponding security metadata to enable the second particular support user to access the particular tenant system of the plurality of tenant systems without disclosing the corresponding security metadata to the second particular support user, and without allowing the second particular support user to access other tenant systems of the plurality of tenant systems in response to the request, and
• remove at least a portion of the mappings in the identity provider module, the at least a portion of the mappings corresponding to the second particular support user account, the at least a portion of the mappings being dynamically removed after one or more second trigger events, the one or more second trigger events including deactivating the second particular support user account.