Keyless authentication scheme of computing services

A computing device in a distributed computing system, the computing device comprising:

• a processor;
• and
• a memory operatively coupled to the processor, the memory containing instructions executable by the processor to cause the computing device to:
• receive, at the computing device, data representing a request for an identity assertion token corresponding to an application executed in a container on a server;
• in response to the request for the identity assertion token,
• determine an application identity under which the application is executed to provide a computing service;
• determine that the application with the application identity is authorized for the identity assertion token based on a first record of authorization policy corresponding to the application identity;
• and
• in response to the determination that the application with the application identity is authorized for the identity assertion token, transmit the identity assertion token to the server;
• receive, at the computing device from the computing service, an authentication request for a security token configured to authenticate the computing service to other computing services in the distributed computing system, the authentication request including the identity assertion token previously issued by the authentication service to the application executed in the container on the server, wherein the identity assertion token includes a digital data package that contains security credentials for the application identity under which the application is executed to provide the computing service;
• in response to the authentication request, determine the application identity of the application executed in the container on the server based on the identity assertion token included in the authentication request;
• and
• access a database for a second record of authorization policy corresponding to the application identity and determine whether the application identity is authorized for issuance of the security token based on the second record of authorization policy;
• in response to determining that the application identity is authorized for the security token, transmit the security token to the computing service, thereby allowing the computing service to authenticate to other computing services in the distributed computing system without using digital certificates.

A method of keyless authentication of computing services to an authentication service in a distributed computing system, the method comprising:

• receiving, at the authentication service, data representing a request for an identity assertion token corresponding to an application from a container manager at a server;
• in response to receiving the request for the identity assertion token,
• determining an application identity of the application and a container manager identity of the container manager;
• accessing a database for a first authorization policy record corresponding to the application identity and the container manager identity;
• and
• determining that the application with the application identity and managed by the container manager is authorized for the identity assertion token based on the first authorization policy record;
• and
• in response to determining that the application with the application identity is authorized for the identity assertion token, generating and transmitting the identity assertion token to the container manager at the server;
• receiving, at the authentication service, data representing an authentication request from a computing service for a security token configured to authenticate the computing service to other computing services in the distributed computing system, the authentication request including the identity assertion token previously issued by the authentication service to the application executed in a container on the server, wherein the identity assertion token includes a digital data package that contains security credentials for the application identity under which the application is executed to provide the computing service;
• and
• in response to receiving the authentication request, at the authentication service,
• determining the application identity of the application executed in the container on the server based on the identity assertion token included in the authentication request;
• accessing a second authorization policy record corresponding to the application identify and determining that the application identity is authorized for issuance of the security token based on the second authorization policy record;
• and
• in response to determining that the application identity is authorized for the security token, transmitting the requested security token to the computing service.