Controlling just in time access to a cluster
AssigneeSalesforce, Inc.
InventorStephen McQuaid
Life of this patent
Estimating the term…
Abstract
Examples include a system and computer-implemented method to receive a notification from an application programming interface (API) of creation of a just in time (JIT) grant, the JIT grant defining a request for a user to be authorized to access a cluster according to a JIT policy; determine if access to the cluster by the user is authorized according to the JIT policy; grant access to the user to the cluster when access is authorized according to the JIT policy; and send a notification to the API that access by the user to the cluster is granted.
Claims20
A role-based access control system, comprising:
- a processing device;
- and
- a memory device,
- the processing device configurable to cause:
- processing an access control policy of just in time (JIT) access received via an interface, the access control policy specifying a role and an expiration time;
- determining that access to a resource by a user is authorized according to the access control policy based, at least in part, on a role of the user;
- granting, to the user, JIT access to the resource until expiration of the expiration time responsive to determining that access is authorized according to the access control policy, wherein granting, to the user, JIT access to the resource includes creating a role binding for the user;
- and
- revoking access by the user to the resource in response to expiration of the expiration time, wherein revoking access includes deleting the role binding for the user.
A computer-implemented method, comprising:
- processing an access control policy of just in time (JIT) access received via an interface, the access control policy specifying a role and an expiration time;
- determining that access to a resource by a user is authorized according to the access control policy based, at least in part, on a role of the user;
- granting, to the user, JIT access to the resource until expiration of the expiration time responsive to determining that access is authorized according to the access control policy, wherein granting, to the user, JIT access to the resource includes creating a role binding for the user;
- and
- revoking access by the user to the resource in response to expiration of the expiration time, wherein revoking access includes deleting the role binding for the user.
At least one tangible non-transitory machine-readable medium comprising a plurality of instructions that in response to being executed by a processor in a computing system, are configurable to cause:
- processing an access control policy of just in time (JIT) access received via an interface, the access control policy specifying a role and an expiration time;
- determining that access to a resource by a user is authorized according to the access control policy based, at least in part, on a role of the user;
- granting, to the user, JIT access to the resource until expiration of the expiration time responsive to determining that access is authorized according to the access control policy, wherein granting, to the user, JIT access to the resource includes creating a role binding for the user;
- and
- revoking access by the user to the resource in response to expiration of the expiration time, wherein revoking access includes deleting the role binding for the user.
Dependencies are inferred from the claim text.