Login authentication in a cloud storage platform

An apparatus comprising a computer processor, a computer memory operatively coupled to the computer processor, the computer memory having disposed within it computer program instructions that, when executed by the computer processor, cause the apparatus to carry out:

• extracting, based on a user identifier for a user, a domain registered with a cloud storage platform, wherein each domain registered with the cloud storage platform is associated with an identity authentication endpoint and one or more groups to which users from the domain may be assigned;
• providing, to an identity authentication endpoint associated with the extracted domain, login credentials for the user;
• receiving an identity authorization from the identity authentication endpoint associated with the extracted domain, wherein the identity authorization comprises a plurality of groups for the user;
• filtering out from the plurality of groups included in the identity authorization, one or more groups that are not registered with the cloud storage platform, wherein the filtering generates a set of one or more registered groups that are a subset of the plurality of groups included in the identity authorization;
• creating a token based on the set of one or more registered groups that are a subset of the plurality of groups included in the identity authorization;
• and
• utilizing the token for authorization and authentication by applications accessible via the cloud storage platform.

A computer program product comprising a non-transitory computer readable medium, the computer program product comprising computer program instructions that, when executed, cause a computer to carry out:

• extracting, based on a user identifier for a user, a domain registered with a cloud storage platform, wherein each domain registered with the cloud storage platform is associated with an identity authentication endpoint and one or more groups to which users from the domain may be assigned;
• providing, to an identity authentication endpoint associated with the extracted domain, login credentials for the user;
• receiving an identity authorization from the identity authentication endpoint associated with the extracted domain, wherein the identity authorization comprises a plurality of groups for the user;
• filtering out from the plurality of groups included in the identity authorization, one or more groups that are not registered with the cloud storage platform, wherein the filtering generates a set of one or more registered groups that are a subset of the plurality of groups included in the identity authorization;
• creating a token based on the set of one or more registered groups that are a subset of the plurality of groups included in the identity authorization;
• and
• utilizing the token for authorization and authentication by applications accessible via the cloud storage platform.