Unified identity and access management (IAM) control plane for services associated with a hybrid cloud

A system comprising:

• a processing resource;
• and
• a non-transitory computer-readable medium, coupled to the processing resource, having stored therein instructions that when executed by the processing resource cause the processing resource to:
• provide a user interface via web portal through which users of a particular tenant of multiple tenants of a managed service provider (MSP) are able to configure permissions for and access resources of a set of services, including internal services and external services associated with a hybrid cloud;
• provide a unified Identity and Access Management (IAM) control plane across the set of services, wherein at least some services of the set of services use a different IAM protocol or a different IAM scheme;
• and
• maintain consistency between a centralized Identity and Access Management (IAM) service utilized by the MSP and an authorization system utilized by a first service of the set of services by:
• responsive to a first change to a permission model of the first service via the authorization system utilized by the first service, reflecting the first change to the centralized IAM service via an application programming interface (API) of the unified IAM control plane by invoking the API by a first authorization broker of a plurality of authorization brokers running within the MSP and corresponding to the first service;
• and
• responsive to a second change to the central IAM service relating to a user or a resource associated with the permission model, reflecting the second change to the authorization system via the first authorization broker such that brokered change events are communicated via the unified IAM control plane to trigger a change in a first authorization system responsive to a change in a second authorization system, wherein the centralized IAM service is based on a space-based access control (SBAC) model, wherein the SBAC model of the centralized IAM service comprises functions of a role-based access control (RBAC) model.

A method comprising:

• providing by a managed service provider (MSP):
• a user interface through which users of multiple tenants are able to configure permissions for and access a plurality of resources of a set of services, including internal services and external services associated with a hybrid cloud;
• and
• a unified Identity and Access Management (IAM) control plane across the set of services, wherein at least some services of the set of services use a different IAM protocol or a different IAM scheme;
• maintaining, by the MSP, a centralized IAM service containing information regarding the permissions for the plurality of resources, wherein the centralized IAM service is based on a space-based access control (SBAC) model, wherein the SBAC model of the centralized IAM service comprises functions of a role-based access control (RBAC) model;
• supporting, by the MSP, a plurality of service integrations for the set of services, including providing:
• a first set of application programming interfaces (APIs) that facilitate a direct integration of the plurality of service integrations with the unified IAM control plane in which the centralized IAM service maintains access control information for resources associated with a first service of the set of services;
• and
• a second set of APIs that facilitate a brokered integration of the plurality of service integrations with the unified IAM control plane including communicating brokered change events via the unified IAM control plane to trigger a change in a first authorization system responsive to a change in a second authorization system.

A non-transitory machine readable medium storing instructions executable by a processing resource of a computer system, the non-transitory machine readable medium comprising instructions to:

• provide a user interface via web portal through which users of a particular tenant of multiple tenants of a managed service provider (MSP) are able to configure permissions for and access a plurality of resources of a set of services, including internal services and external services associated with a hybrid cloud;
• provide a unified Identity and Access Management (IAM) control plane across the set of services, wherein at least some services of the set of services use a different IAM protocol or a different IAM scheme;
• maintain a centralized IAM service containing information regarding the permissions for the plurality of resources, wherein the centralized IAM service is based on a space-based access control (SBAC) model, wherein the SBAC model of the centralized IAM service comprises functions of a role-based access control (RBAC) model;
• and
• support a plurality of service integrations for the set of services, including providing:
• a first set of application programming interfaces (APIs) that facilitate a direct integration of the plurality of service integrations with the unified IAM control plane in which the centralized IAM service maintains access control information for resources associated with a first service of the set of services;
• and
• a second set of APIs that facilitate a brokered integration of the plurality of service integrations with the unified IAM control plane including communicating brokered change events via the unified IAM control plane to trigger a change in a first authorization system responsive to a change in a second authorization system.