Hybrid access control model in computer systems

A host computing device operating in the cloud-services computing environment, the host computing device comprising:

• one or more processors;
• and
• memory storing one or more programs configured to be executed by the one or more processors, the one or more programs including instructions for:
• obtaining access control settings associated with a hierarchical computing resource system, wherein the access control settings include at least a first user's role based access settings defining access rights with respect to a first sub-system of the hierarchical computing-resource system;
• determining the access control settings from the first sub-system that are to be hierarchically propagated to a second sub-system of the hierarchical computing-resource system, wherein the second sub-system is a child sub-system of the first sub-system;
• obtaining user group domains assigned correspondingly to sets of sub-systems from a plurality of sub-systems of the hierarchical computing-resource system, the plurality of sub-systems including the first sub-system and the second sub-system, wherein the user group domains include a first user group domain assigned to the first sub-system and not to the second sub-system and a second user group domain assigned to the second sub-system and not to the first sub-system, wherein the first user group domain is associated with a tenant of the cloud-services computing environment, and the second user group domain is associated with the service provider of the cloud-services computing environment;
• obtaining user group domains comprising:
• receiving domain data representing the user group domains associated with the hierarchical computing-resource system;
• and
• annotating the plurality of sub-systems of the hierarchical computing-resource system with the domain data;
• obtaining a tenant group membership associated with the first user;
• determining that the first user is assigned to the first user group domain, based on the obtained tenant group membership associated with the first user;
• determining, based on the obtained user group domains and the obtained tenant group membership associated with the first user, whether the first user's role-based access settings to be hierarchically propagated from the first sub-system to the second sub-system are to be adjusted;
• and
• in accordance with a determination that the first user's role-based access settings to be hierarchically propagated to the second sub-system are to be adjusted, adjusting the first user's role-based access settings propagated to the second sub-system such that adjusted first user's role-based access settings provided to the second sub-system no longer allow access to the second sub-system based on determining that the first user is not a member of a service provider group membership corresponding to the second user group domain assigned to the second sub-system.

A non-transitory computer-readable storage medium storing one or more programs configured to be executed by a host computing device operating in a cloud services computing environment having one or more processors and memory, the one or more programs including instructions for:

• obtaining access control settings associated with a hierarchical computing resource system, wherein the access control settings include at least a first user's role based access settings defining access rights with respect to a first sub-system of the hierarchical computing-resource system;
• determining the access control settings from the first sub-system that are to be hierarchically propagated to a second sub-system of the hierarchical computing-resource system, wherein the second sub-system is a child sub-system of the first sub-system;
• obtaining user group domains assigned correspondingly to sets of sub-systems from a plurality of sub-systems of the hierarchical computing-resource system, the plurality of sub-systems including the first sub-system and the second sub-system, wherein the user group domains include a first user group domain assigned to the first sub-system and not to the second sub-system and a second user group domain assigned to the second sub-system and not to the first sub-system, wherein the first user group domain is associated with a tenant of the cloud-services computing environment, and the second user group domain is associated with the service provider of the cloud-services computing environment, obtaining user group domains comprising:
• receiving domain data representing the user group domains associated with the hierarchical computing-resource system;
• and
• annotating the plurality of sub-systems of the hierarchical computing-resource system with the domain data;
• obtaining a tenant group membership associated with the first user;
• determining that the first user is assigned to the first user group domain, based on the obtained tenant group membership associated with the first user;
• determining, based on the obtained user group domains and the obtained tenant group membership associated with the first user, whether the first user's role-based access settings to be hierarchically propagated from the first sub-system to the second sub system are to be adjusted;
• and
• in accordance with a determination that the first user's role-based access settings to be hierarchically propagated to the second sub-system are to be adjusted, adjusting the first user's role-based access settings propagated to the second sub-system such that adjusted first user's role-based access settings provided to the second sub-system no longer allow access to the second sub-system based on determining that the first user is not a member of a service provider group membership corresponding to the second user group domain assigned to the second sub-system.