Mediated authentication and authorization for service consumption and billing

A non-transitory, computer-readable medium storing one or more instructions executable by a computer system to perform operations comprising:

• receiving a request for execution of a cloud service for a user of a customer of a cloud-computing platform, the request including a user identifier of the user but not a password for the user;
• determining the customer from the user identifier included in the request for execution of the cloud service;
• determining a cloud connector endpoint for the customer, the cloud connector endpoint identifying a secure cloud connector tunnel for communication with a user mapper installed in a customer landscape of the customer;
• sending an authorization and authentication request, using the secure cloud connector tunnel, to the user mapper, wherein the user mapper is configured to authenticate the user within the customer landscape and determine whether the user is authorized to use the requested cloud service;
• receiving an authorization and authentication response from the user mapper that indicates whether the user is an authenticated user who is authorized to use the cloud service;
• in response to the authorization and authentication response indicating that the user is an authenticated user who is authorized to use the cloud service, granting a cloud token that enables use of the cloud service.

A computer-implemented system, comprising:

• one or more computers;
• and
• one or more computer memory devices interoperably coupled with the one or more computers and having tangible, non-transitory, machine-readable media storing one or more instructions that, when executed by the one or more computers, perform one or more operations comprising:
• receiving a request for execution of a cloud service for a user of a customer of a cloud-computing platform, the request including a user identifier of the user but not a password for the user;
• determining the customer from the user identifier included in the request for execution of the cloud service;
• determining a cloud connector endpoint for the customer, the cloud connector endpoint identifying a secure cloud connector tunnel for communication with a user mapper installed in a customer landscape of the customer;
• sending an authorization and authentication request, using the secure cloud connector tunnel, to the user mapper, wherein the user mapper is configured to authenticate the user within the customer landscape and determine whether the user is authorized to use the requested cloud service;
• receiving an authorization and authentication response from the user mapper that indicates whether the user is an authenticated user who is authorized to use the cloud service;
• in response to the authorization and authentication response indicating that the user is an authenticated user who is authorized to use the cloud service, granting a cloud token that enables use of the cloud service.