Secure service deployment and access layer spanning multi-cluster environments

A system for securely managing data in a large-scale computer network coupling one or more client computer to a server and having multiple clusters, comprising:

• a centralized application management process deployed in the server and comprising an authentication sub-system and a cluster access sub-system;
• a respective identity federation subsystem and a respective cluster administration subsystem deployed in each cluster of the multiple clusters;
• the cluster administration subsystem exchanging information about each cluster to a cluster registration and discovery subsystem of the server;
• an identity federation subsystem in a cluster communicating securely with services on the cluster and propagate an identity of a logged-in user to each service in the cluster;
• an interface passing, from the authentication subsystem, an encoded token for the logged-in user to the identity federation subsystem in the cluster;
• a management component using the token to provide authorized access to each service on the cluster;
• and
• a discovery component discovering other services in the clusters by each respective cluster administration subsystem, and setting up a Single Sign On (SSO) configuration for the service and the other services in the clusters to enable single sign on for the user on all clusters in the network.

A computer program product containing software code, which when executed by a hardware processor, cause a computer to perform a method for securely managing data in a large-scale computer network coupling one or more client computer to a server and having multiple clusters having respective services, and comprising:

• deploying, in the server, a centralized application management process executed by the hardware processor and comprising an authentication sub-system and a cluster access sub-system;
• deploying, in each cluster of the multiple clusters, a respective identity federation subsystem and a respective cluster administration subsystem;
• exchanging through the respective cluster administration subsystem, information about each cluster to a cluster registration and discovery subsystem of the server;
• using the respective identity federation subsystem in a cluster to communicate securely with services on the cluster and propagate an identity of a logged-in user to each service in the cluster;
• passing, from the authentication subsystem, an encoded token for the logged-in user to the identity federation subsystem in the cluster;
• and
• using the token to provide authorized access to each service on the cluster;
• discovering other services in the clusters by each respective cluster administration subsystem;
• and
• setting up a Single Sign On (SSO) configuration for the service and the other services in the clusters to enable single sign on for the user on all clusters in the network.