Tenant-aware distributed application authentication

One or more non-transitory computer-readable media comprising computer-executable instructions that when executed cause a computing system to perform a method of authenticating clients accessing a cluster of a plurality of application hosting platform instances, the method comprising:

• from a client authenticated to access a first application hosted on a first application hosting platform instance of the cluster via an authentication token, receiving, at a second instance of the application hosting platform, a request to access a second application hosted on the second application hosting platform instance of the cluster;
• responsive to the request, fetching the authentication token from the client to the second instance of the application hosting platform;
• determining one of the application hosting platform instances of the cluster as being a primary authentication application hosting platform instance based on tenant-specific authentication configuration information comprising a specified primary authentication application hosting platform instance, wherein the tenant-specific authentication configuration information comprising the specified primary authentication application hosting platform instance is configurable per tenant;
• sending a validation request for the authentication token to the primary authentication application hosting platform instance;
• receiving validation confirmation of the authentication token from the primary authentication application hosting platform instance;
• and
• responsive to receiving validation confirmation, granting access to the second application hosted on the second application hosting platform instance to the client.

A computing system comprising:

• one or more processors;
• memory;
• a plurality of application hosting platform instances comprising respective platform authentication services configured to store and validate authentication tokens, one or more respective hosted applications, and tenant-specific configuration information comprises tenant-specific authentication configuration information for a plurality of tenants;
• wherein the platform authentication services of the application hosting platform instances are configured to serve as a primary platform authentication service according to the tenant-specific authentication configuration information of a given tenant of the tenants, and the tenant-specific authentication configuration information is configurable per tenant;
• wherein the tenant-specific configuration information comprises application configuration information that specifies which applications are to be hosted at which application hosting platform instances and is configurable per tenant;
• and
• wherein the platform authentication services are configured to redirect authentication requests from the hosted applications for the given tenant to the primary platform authentication service specified for the given tenant in the tenant-specific authentication configuration information.

One or more non-transitory computer-readable media comprising computer-executable instructions that when executed cause a computing system to perform a method comprising:

• in a computing cluster spanning a plurality of data centers supporting a plurality of tenants, receiving, from a client authenticated to access a first application via a bearer authentication token granted by a primary platform authentication service as a result of authentication by an identity provider specified in confirmation information for a particular tenant out of the plurality of tenants, a request to access a second application;
• fetching the bearer authentication token from the client;
• determining a primary authentication application hosting platform instance for the client based on tenant-specific authentication configuration information, wherein the tenant-specific authentication configuration information is configurable per tenant, at least one tenant specifies a given primary authentication application hosting platform instance that is different from that of another tenant, and the given primary authentication application hosting platform instance is specified as a geographical location and converted to a reference to an instance at the geographical location or a service executing at the instance at the geographical location;
• sending an authentication request to the primary platform authentication service of the primary authentication application hosting platform instance for validation, wherein the authentication request comprises the bearer authentication token, a tenant identifier of the particular tenant, an application instance identifier of the second application, and an application secret of the second application;
• receiving a communication from the primary platform authentication service indicating that the authentication request is valid;
• and
• responsive to receiving the communication that the authentication request is valid, granting access by the client to the second application;
• wherein the first application is hosted by a first instance of an application hosting platform executing at a first data center, and the second application is hosted by a second, different instance of the application hosting platform executing at a second, different data center.