Authenticating computing system requests with an unknown destination across tenants of a multi-tenant system
Assigneesalesforce.com, inc.
InventorsMatthew Bahrenburg, Alan Vangpat, Anupam Jain, Koson Thambundit, Sanjay Thakkar
Life of this patent
Estimating the term…
Abstract
Disclosed are some implementations of systems, apparatus, methods and computer program products for facilitating the authentication of computing system requests with an unknown destination across tenants of at least one multi-tenant database system. Authentication is facilitated using an intermediate system that is accessible by and independent from the tenants of the multi-tenant database system.
Claims20
A system comprising:
- a database system implemented using a server system, the database system configurable to cause:
- processing at least one system request, the system request at least one of pertaining to or including a tenant request transmitted by a computing system of a first tenant of a plurality of tenants of a database system, the system request including an identifier of the first tenant, an identifier of a particular trust group to which the tenant request is directed, and an indication of at least one of data or an application to which the first tenant requests access;
- performing a lookup in a registry to obtain a public key of the first tenant, the registry including metadata corresponding to the plurality of tenants, the metadata of the registry indicating, for each of the tenants, a public key and trust group memberships;
- facilitating, using the public key of the first tenant, authentication of the tenant request;
- verifying, using the registry, that the first tenant is a member of the particular trust group;
- and
- verifying, using the registry, that the first tenant is authorized to access the data or application to which the first tenant requests access.
A computer program product comprising computer-readable program code capable of being executed by one or more processors when retrieved from a non-transitory computer-readable medium, the program code comprising computer-readable instructions configurable to cause
- processing at least one system request, the system request at least one of pertaining to or including a tenant request transmitted by a computing system of a first tenant of a plurality of tenants of at database system, the system request including an identifier of the first tenant, an identifier of a particular trust group to which the tenant request is directed, and an indication of at least one of data or an application to which the first tenant requests access;
- performing a lookup in a registry to obtain a public key of the first tenant, the registry including metadata corresponding to the plurality of tenants, the metadata of the registry indicating, for each of the tenants, a public key and trust group memberships;
- facilitating, using the public key of the first tenant, authentication of the tenant request;
- verifying, using the registry, that the first tenant is a member of the particular trust group;
- and
- verifying, using the registry, that the first tenant is authorized to access the data or application to which the first tenant requests access.
A method, comprising:
- processing at least one system request, the system request at least one of pertaining to or including a tenant request transmitted by a computing system of a first tenant of a plurality of tenants of a database system, the system request including an identifier of the first tenant, an identifier of a particular trust group to which the tenant request is directed, and an indication of at least one of data or an application to which the first tenant requests access;
- performing a lookup in a registry to obtain a public key of the first tenant, the registry including metadata corresponding to the plurality of tenants, the metadata of the registry indicating, for each of the tenants, a public key and trust group memberships;
- facilitating, using the public key of the first tenant, authentication of the tenant request;
- verifying, using the registry, that the first tenant is a member of the particular trust group;
- and
- verifying, using the registry, that the first tenant is authorized to access the data or application to which the first tenant requests access.
Dependencies are inferred from the claim text.