Cloud-based secrets management credential store

A method of credentialing, accessing and using one or more networked services of a cloud computing infrastructure by a user of a client computer, the method comprising:

• receiving, an identity-based access management system accessible by the client computer via an application programming interface (API), a request for a session to use a specific service of the one or more networked services, the identity-based access management system having a credential store that includes a credential library that receives and stores credentials for authorizing and enabling the session with the specific service of the one or more networked services;
• authorizing, by a target service of the identity-based access management system, the session based on the received credentials;
• receiving, from a secrets management system associated with the identity-based access management system, an authentication for the user and the client computer to access and use the specific service authorized by the target service of the identity-based access management system;
• and
• accessing, by the identity-based access management system, a lease generated by the secrets management system to a credential that is transmitted to the client computer to authorize and enable the session with the specific service of the one or more networked services of the cloud computing infrastructure,
• wherein the identity-based access management system is further configured such that only lease metadata for the credential is retained by the identity-based access management system, and
• wherein an internal scheduler of the identity-based access management system is configured to periodically renew the lease for the credential while the session is active, and wherein, upon termination of the session, the identity-based access management system is further configured to programmatically call the secrets management system to revoke the lease for the credential.

A computer program product comprising a non-transitory machine-readable medium storing instructions that, when executed by one or more programmable processors, cause the one or more programmable processors to perform operations to credential, access and use one or more networked services of a cloud computing infrastructure by a user of a client computer, the operations comprising:

• receive, via an application programming interface (API) accessible by the client computer, a request for a session to use a specific service of the one or more networked services, the request being received by an identity-based access management system having a credential store that includes a credential library that receives and stores credentials for authorizing and enabling the session with the specific service of the one or more networked services;
• authorize the session based on the received credentials;
• authenticate the user and the client computer to access and use the specific service authorized by the target service of the identity-based access management system;
• and
• generate a lease to a credential that is transmitted to the client computer to authorize and enable the session with the specific service of the one or more networked services of the cloud computing infrastructure,
• wherein the identity-based access management system is further configured such that only lease metadata for the credential is retained by the identity-based access management system, and
• wherein an internal scheduler of the identity-based access management system is configured to periodically renew the lease for the credential while the session is active, and wherein, upon termination of the session, the identity-based access management system is further configured to programmatically call a secrets management system to revoke the lease for the credential.