Extending infrastructure security to services in a cloud computing environment

Apparatus, comprising:

• a processor;
• computer memory holding computer program instructions that when executed by the processor provide a security service, the computer program instructions further executed by the processor to provide a method to extend cloud computing infrastructure security to a service that is shared across virtual application deployments in the cloud computing infrastructure as a shared service, the method comprising:
• establishing a trust relationship between the shared service and the security service;
• upon receipt of a request from a user to access the shared service, the request issued from an application other than the shared service, executing a token exchange among the application, the security service and the shared service to exchange a first token for a shared services token that is distinct from the first token, the first token representing the user within the security service and identifying what privileges the user has and resources the user can access, the shared services token including credential information and one or more deployment constraints on authorized access to the shared service, the credential information including user identity and one or more security roles, the token exchange that exchanges the first token for the shared services token executed transparently to a provider of the shared service;
• and
• issuing to the shared service the shared services token, the credential information therein facilitating a transfer of control from the application to a shared service interface to enable access to the shared service by the user without challenge.

A computer program product in a non-transitory computer readable medium for use in a data processing system that provides a security service, the non-transitory computer readable medium comprising computer program instructions stored thereon which, when executed by the data processing system, provide a method to extend cloud computing infrastructure security to a service that is shared across virtual application deployments in the cloud computing infrastructure as a shared service, the method comprising:

• establishing a trust relationship between the shared service and the security service;
• upon receipt of a request from a user to access the shared service, the request issued from an application other than the shared service, executing a token exchange among the application, the security service and the shared service to exchange a first token for a shared services token that is distinct from the first token, the first token representing the user within the security service and identifying what privileges the user has and resources the user can access, the shared services token including credential information and one or more deployment constraints on authorized access to the shared service, the credential information including user identity and one or more security roles, the token exchange that exchanges the first token for the shared services token executed transparently to a provider of the shared service;
• and
• issuing to the shared service the shared services token, the credential information therein facilitating a transfer of control from the application to a shared service interface to enable access to the shared service by the user without challenge.