Welcome!

Java IoT Authors: Pat Romanski, Liz McMillan, Elizabeth White, Stackify Blog, Carmen Gonzalez

Related Topics: Java IoT, Microservices Expo

Java IoT: Article

Access Control in Multi-Tenant Applications

Defining "Who sees what" and "who does what" are the two important aspects of access control in any software application

Defining "Who sees what" and "who does what" are the two important aspects of access control in any software application.

"Security" is a much larger subject, but this article focuses on just the access control aspects of security in a software application.

The Older Paradigm: Roles and Page-Level Access Controls
When you build a custom application for a specific customer, the access control policies of the organization are often defined upfront as part of the requirements phase. Depending on the vertical, domain and the specific organizational structure of the business, first the roles are defined. And then each role is given access to a set of screens, forms, pages and reports. What role A sees might be different from what role B sees. What role A can do could be different from what role B is allowed to do. Of course, certain areas in the application can be accessed by multiple roles. While building software products (used by several customers), the roles are often generalized and predefined. The various access control policies of the product are often hard coded in to the roles. The customer will be able to assign one or more roles to their users.

The New Paradigm: Privilege-Based Access Controls
In the new paradigm, before doing any action (including showing something on the screen - which is the View action), you check / demand for the privilege to view that information or do a certain action. It could be standard actions such as view, edit and delete or special privileges such as "Access to History Data" or "Access to information or content created by people other than myself. In the new paradigm, a user / roles privileges are resolved during run time - not hard coded at design time. This allows the product developer to complete the development just by demanding the necessary privileges at each step, without having to worry about the users and roles in the system.

Mapping Privileges to Roles
By enumerating the various privileges (entity wise or form wise standard privileges as well as special privileges) in an administration screen, we can allow the end customer to map the privileges to any specific role, during run time. This takes care of dynamic changes in organizational policy. This also allows the end customer to create completely new roles (not originally envisaged by the product designer) dynamically during actual usage and map a set of privileges to these new roles using an admin screen.
For example in a HR product, the product might have default roles such as "Employee" and "Manager" whereas a customer may create a new role called "Team Leader" or "Mentor."

Subsequently, users can be assigned with one or more roles (including new custom roles). So when a user is using the system, the application can resolve who the user is, what his or her role is, what the privileges of the role are - all during run time. So before a particular action, the application can simply check whether the required privilege is available for the user and proceed. While this may seem little challenging from the software design/development front, it will bring in lot of flexibility for the customers.

Relationship-Based Privileges
Many a time, mapping privileges to roles and assigning roles to users is also not adequate. Let's illustrate this with an example:

[email protected] has logged in to a performance management product. She has been assigned the role of a "Manager" and a set of Privileges have been assigned to this role. For example she can add certain new skills in the skills master, which another user with an "Employee" role cannot do.

But the real challenge however is in defining what she can and cannot see and what she can and cannot do with respect to the performance appraisal ratings of various employees.

Out of the 300 people in the organization, userX, is a "Primary Manager" for 4 employees, "Co-Manager for 5 employees", "Mentor" for 5 employees, "Department Head for 40 employees", and "Peer" for 15 employees. She is not related to the rest of the employees in the organization (in the context of performance management).

The privileges of what each of these "Relationships" can and cannot do is different. For example, a Mentor can view performance ratings but cannot edit them. A Primary Manager can edit ratings, but cannot approve them. And a Department head can approve/disapprove ratings, but cannot edit them.

How can we allow userX to login in once, view all the employees related to her in a single grid, but restrict her access depending on the relationship between her and the employee on whom she is performing the action?

  • Step 1: Define relationships in a master: This could be added / edited by the end customer.
  • Step 2: Map each privilege to a set of relationships who are to be given this privilege.
  • Step 3: Resolve the relationship between the user and the employee during run time and accordingly deduce whether the user has or does not have the privilege to do an action.

Static Data Scope
Apart from defining what a role can or cannot do / see, we often also want to restrict the boundaries of the data that the user has access to. For example, "Can edit employee profile information - but - only for people in his division / department", "Can see salary details - but only for employees reporting to her or to her down the line reports". Another example is to say that the Sales manager can access leads / customers only from his territory.

These datascopes should not be hard coded in the product, but should be configurable by an end customer. For each role and privilege mapping, the data scope can also be mapped.

The meanings of these datascopes are defined as "Meta data" which are nothing but Filter conditions. These filter conditions should be dynamically applied on the data set being accessed during run time, depending on the role-privilege-data scope resolved for the user context.

Dynamic Data Scope
This is an extended form of data scope, where the variable being defined for the data scope is itself defined dynamically.

For example, an "HR Administrator" role assigned to "User A" should administer for employees in "Location, P, Q and R" and "HR Administrator" role assigned to "User B" should administer for employees in "Location S, T and V" - where the location itself is user defined by the end customer in a Location Master.

Or Finance Manager should be able see the books of Divisions "A, B, C and D" where the Divisions itself is user defined by the end customer in a Division master.

Multi-Tenant Access Control
When the roles, relationships, privileges, static and dynamic data scopes are user definable by the end customer, and when the sample application serves multiple customers / tenants (from a single instance of the application), then we need to store all these access control configurations - tenant wise. So during run time, we should not only resolve the data scopes-privileges-roles-users, but also apply the tenant context and look up the appropriate tenant specific access control settings, before deciding to allow or disallow a particular action in the application.

Privilege mapping should be possible at the field Level, entity Level, form Level and page Level, so that the end customer / tenant has absolute control and flexibility in defining and modifying "Who sees what" and "Who can do what" in the system.

Tying in Subscription/ License Control with Access Control
Different tenants/ customers/ user groups should be given access or denied access to different modules and features in the product. This depends on the package that they have bought (in a SaaS product) or based on the Organizational Policy (in a Private/ Internal SaaS product).

These modules and features have to be first defined as Meta data and the corresponding page level access controls have to be mapped to them. This will allow the product to hide or show certain menu items and links to users depending on the tenant context and the packages enabled for that tenant/ user group.

Usage-Based Quota and Access Control
Many a times tenants are allowed to use the product for a specific no. of users or for a specified quota of usage (For example can do XXX no. of market surveys). These transactions and events have to be metered in the product, and once the defined quota is exceeded, the access control system should deny access to any user belonging to that tenant / user group.

Summary
The Access Control Paradigm of a Multi-tenant Application/ SaaS Product, should enlarge its frame of reference to include extensive customizability and configurability to suit different customers and organizations while still maintaining a single instance and code base.

The engineering stack of a Multi - tenant SaaS product, should have a robust and flexible Access Control layer, so that all the dynamic and run time capabilities are handled at the framework level. The developer then can focus on building the business functions, follow the guidelines provided by the underlying framework and demand a privilege before doing any significant action.

More Stories By Sathiya Rajendhran

Ramkumar is the Founder and Director of Mango DVM, a venture capital funded company in the digital music space, currently going through a third round of funding. He is also the Director of Product Management at Asteor Software Inc, where he was instrumental in incubating and bringing to market two new software products (Techcello & Synergita). He is also the Director of RSR Innovations, a consultancy firm specializing on Strategic Marketing, Innovation and Leadership Development.

Before becoming an entrepreneur, Ramkumar had spent over two decades in various corporates; in functions such as Automation Engineering, Project management, Product management, Marketing and General management.

@ThingsExpo Stories
The 21st International Cloud Expo has announced that its Call for Papers is open. Cloud Expo, to be held October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA, brings together Cloud Computing, Big Data, Internet of Things, DevOps, Digital Transformation, Machine Learning and WebRTC to one location. With cloud computing driving a higher percentage of enterprise IT budgets every year, it becomes increasingly important to plant your flag in this fast-expanding busin...
Internet of @ThingsExpo, taking place October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with the 21st International Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. @ThingsExpo Silicon Valley Call for Papers is now open.
As cloud adoption continues to transform business, today's global enterprises are challenged with managing a growing amount of information living outside of the data center. The rapid adoption of IoT and increasingly mobile workforce are exacerbating the problem. Ensuring secure data sharing and efficient backup poses capacity and bandwidth considerations as well as policy and regulatory compliance issues.
DevOps is often described as a combination of technology and culture. Without both, DevOps isn't complete. However, applying the culture to outdated technology is a recipe for disaster; as response times grow and connections between teams are delayed by technology, the culture will die. A Nutanix Enterprise Cloud has many benefits that provide the needed base for a true DevOps paradigm.
SYS-CON Events announced today that SoftLayer, an IBM Company, has been named “Gold Sponsor” of SYS-CON's 18th Cloud Expo, which will take place on June 7-9, 2016, at the Javits Center in New York, New York. SoftLayer, an IBM Company, provides cloud infrastructure as a service from a growing number of data centers and network points of presence around the world. SoftLayer’s customers range from Web startups to global enterprises.
Five years ago development was seen as a dead-end career, now it’s anything but – with an explosion in mobile and IoT initiatives increasing the demand for skilled engineers. But apart from having a ready supply of great coders, what constitutes true ‘DevOps Royalty’? It’ll be the ability to craft resilient architectures, supportability, security everywhere across the software lifecycle. In his keynote at @DevOpsSummit at 20th Cloud Expo, Jeffrey Scheaffer, GM and SVP, Continuous Delivery Busine...
SYS-CON Events announced today that Outscale will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Outscale's technology makes an automated and adaptable Cloud available to businesses, supporting them in the most complex IT projects while controlling their operational aspects. You boost your IT infrastructure's reactivity, with request responses that only take a few seconds.
SYS-CON Events announced today that Loom Systems will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Founded in 2015, Loom Systems delivers an advanced AI solution to predict and prevent problems in the digital business. Loom stands alone in the industry as an AI analysis platform requiring no prior math knowledge from operators, leveraging the existing staff to succeed in the digital era. With offices in S...
SYS-CON Events announced today that DivvyCloud will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. DivvyCloud software enables organizations to achieve their cloud computing goals by simplifying and automating security, compliance and cost optimization of public and private cloud infrastructure. Using DivvyCloud, customers can leverage programmatic Bots to identify and remediate common cloud problems in rea...
SYS-CON Events announced today that Tintri, Inc, a leading provider of enterprise cloud infrastructure, will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Tintri offers an enterprise cloud platform built with public cloud-like web services and RESTful APIs. Organizations use Tintri all-flash storage with scale-out and automation as a foundation for their own clouds – to build agile development environments...
SYS-CON Events announced today that Progress, a global leader in application development, has been named “Bronze Sponsor” of SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Enterprises today are rapidly adopting the cloud, while continuing to retain business-critical/sensitive data inside the firewall. This is creating two separate data silos – one inside the firewall and the other outside the firewall. Cloud ISVs ofte...
SYS-CON Events announced today that Tappest will exhibit MooseFS at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. MooseFS is a breakthrough concept in the storage industry. It allows you to secure stored data with either duplication or erasure coding using any server. The newest – 4.0 version of the software enables users to maintain the redundancy level with even 50% less hard drive space required. The software func...
SYS-CON Events announced today that Interoute has been named “Bronze Sponsor” of SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Interoute is the owner operator of Europe's largest network and a global cloud services platform, which encompasses over 70,000 km of lit fiber, 15 data centers, 17 virtual data centers and 33 colocation centers, with connections to 195 additional partner data centers. Our full-service Unifie...
SYS-CON Events announced today that EARP will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. "We are a software house, so we perfectly understand challenges that other software houses face in their projects. We can augment a team, that will work with the same standards and processes as our partners' internal teams. Our teams will deliver the same quality within the required time and budget just as our partn...
SYS-CON Events announced today that Carbonite will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Carbonite protects your entire IT footprint with the right level of protection for each workload, ensuring lower costs and dependable solutions with DoubleTake and Evault.
SYS-CON Events announced today that Super Micro Computer, Inc., a global leader in compute, storage and networking technologies, will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Supermicro (NASDAQ: SMCI), the leading innovator in high-performance, high-efficiency server technology, is a premier provider of advanced server Building Block Solutions® for Data Center, Cloud Computing, Enterprise IT, Hadoop/...
SYS-CON Events announced today that Technologic Systems Inc., an embedded systems solutions company, will exhibit at SYS-CON's @ThingsExpo, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Technologic Systems is an embedded systems company with headquarters in Fountain Hills, Arizona. They have been in business for 32 years, helping more than 8,000 OEM customers and building over a hundred COTS products that have never been discontinued. Technologic Systems’ pr...
SYS-CON Events announced today that Progress, a global leader in application development, has been named “Bronze Sponsor” of SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Enterprises today are rapidly adopting the cloud, while continuing to retain business-critical/sensitive data inside the firewall. This is creating two separate data silos – one inside the firewall and the other outside the firewall. Cloud ISVs oft...
SYS-CON Events announced today that Cloudistics, an on-premises cloud computing company, has been named “Bronze Sponsor” of SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Cloudistics delivers a complete public cloud experience with composable on-premises infrastructures to medium and large enterprises. Its software-defined technology natively converges network, storage, compute, virtualization, and management into a ...
New competitors, disruptive technologies, and growing expectations are pushing every business to both adopt and deliver new digital services. This ‘Digital Transformation’ demands rapid delivery and continuous iteration of new competitive services via multiple channels, which in turn demands new service delivery techniques – including DevOps. In this power panel at @DevOpsSummit 20th Cloud Expo, moderated by DevOps Conference Co-Chair Andi Mann, panelists will examine how DevOps helps to meet th...