Welcome!

Java IoT Authors: Yeshim Deniz, Roger Strukhoff, Carmen Gonzalez, Elizabeth White, Stefan Bernbo

Related Topics: Java IoT, Microservices Expo

Java IoT: Article

Access Control in Multi-Tenant Applications

Defining "Who sees what" and "who does what" are the two important aspects of access control in any software application

Defining "Who sees what" and "who does what" are the two important aspects of access control in any software application.

"Security" is a much larger subject, but this article focuses on just the access control aspects of security in a software application.

The Older Paradigm: Roles and Page-Level Access Controls
When you build a custom application for a specific customer, the access control policies of the organization are often defined upfront as part of the requirements phase. Depending on the vertical, domain and the specific organizational structure of the business, first the roles are defined. And then each role is given access to a set of screens, forms, pages and reports. What role A sees might be different from what role B sees. What role A can do could be different from what role B is allowed to do. Of course, certain areas in the application can be accessed by multiple roles. While building software products (used by several customers), the roles are often generalized and predefined. The various access control policies of the product are often hard coded in to the roles. The customer will be able to assign one or more roles to their users.

The New Paradigm: Privilege-Based Access Controls
In the new paradigm, before doing any action (including showing something on the screen - which is the View action), you check / demand for the privilege to view that information or do a certain action. It could be standard actions such as view, edit and delete or special privileges such as "Access to History Data" or "Access to information or content created by people other than myself. In the new paradigm, a user / roles privileges are resolved during run time - not hard coded at design time. This allows the product developer to complete the development just by demanding the necessary privileges at each step, without having to worry about the users and roles in the system.

Mapping Privileges to Roles
By enumerating the various privileges (entity wise or form wise standard privileges as well as special privileges) in an administration screen, we can allow the end customer to map the privileges to any specific role, during run time. This takes care of dynamic changes in organizational policy. This also allows the end customer to create completely new roles (not originally envisaged by the product designer) dynamically during actual usage and map a set of privileges to these new roles using an admin screen.
For example in a HR product, the product might have default roles such as "Employee" and "Manager" whereas a customer may create a new role called "Team Leader" or "Mentor."

Subsequently, users can be assigned with one or more roles (including new custom roles). So when a user is using the system, the application can resolve who the user is, what his or her role is, what the privileges of the role are - all during run time. So before a particular action, the application can simply check whether the required privilege is available for the user and proceed. While this may seem little challenging from the software design/development front, it will bring in lot of flexibility for the customers.

Relationship-Based Privileges
Many a time, mapping privileges to roles and assigning roles to users is also not adequate. Let's illustrate this with an example:

[email protected] has logged in to a performance management product. She has been assigned the role of a "Manager" and a set of Privileges have been assigned to this role. For example she can add certain new skills in the skills master, which another user with an "Employee" role cannot do.

But the real challenge however is in defining what she can and cannot see and what she can and cannot do with respect to the performance appraisal ratings of various employees.

Out of the 300 people in the organization, userX, is a "Primary Manager" for 4 employees, "Co-Manager for 5 employees", "Mentor" for 5 employees, "Department Head for 40 employees", and "Peer" for 15 employees. She is not related to the rest of the employees in the organization (in the context of performance management).

The privileges of what each of these "Relationships" can and cannot do is different. For example, a Mentor can view performance ratings but cannot edit them. A Primary Manager can edit ratings, but cannot approve them. And a Department head can approve/disapprove ratings, but cannot edit them.

How can we allow userX to login in once, view all the employees related to her in a single grid, but restrict her access depending on the relationship between her and the employee on whom she is performing the action?

  • Step 1: Define relationships in a master: This could be added / edited by the end customer.
  • Step 2: Map each privilege to a set of relationships who are to be given this privilege.
  • Step 3: Resolve the relationship between the user and the employee during run time and accordingly deduce whether the user has or does not have the privilege to do an action.

Static Data Scope
Apart from defining what a role can or cannot do / see, we often also want to restrict the boundaries of the data that the user has access to. For example, "Can edit employee profile information - but - only for people in his division / department", "Can see salary details - but only for employees reporting to her or to her down the line reports". Another example is to say that the Sales manager can access leads / customers only from his territory.

These datascopes should not be hard coded in the product, but should be configurable by an end customer. For each role and privilege mapping, the data scope can also be mapped.

The meanings of these datascopes are defined as "Meta data" which are nothing but Filter conditions. These filter conditions should be dynamically applied on the data set being accessed during run time, depending on the role-privilege-data scope resolved for the user context.

Dynamic Data Scope
This is an extended form of data scope, where the variable being defined for the data scope is itself defined dynamically.

For example, an "HR Administrator" role assigned to "User A" should administer for employees in "Location, P, Q and R" and "HR Administrator" role assigned to "User B" should administer for employees in "Location S, T and V" - where the location itself is user defined by the end customer in a Location Master.

Or Finance Manager should be able see the books of Divisions "A, B, C and D" where the Divisions itself is user defined by the end customer in a Division master.

Multi-Tenant Access Control
When the roles, relationships, privileges, static and dynamic data scopes are user definable by the end customer, and when the sample application serves multiple customers / tenants (from a single instance of the application), then we need to store all these access control configurations - tenant wise. So during run time, we should not only resolve the data scopes-privileges-roles-users, but also apply the tenant context and look up the appropriate tenant specific access control settings, before deciding to allow or disallow a particular action in the application.

Privilege mapping should be possible at the field Level, entity Level, form Level and page Level, so that the end customer / tenant has absolute control and flexibility in defining and modifying "Who sees what" and "Who can do what" in the system.

Tying in Subscription/ License Control with Access Control
Different tenants/ customers/ user groups should be given access or denied access to different modules and features in the product. This depends on the package that they have bought (in a SaaS product) or based on the Organizational Policy (in a Private/ Internal SaaS product).

These modules and features have to be first defined as Meta data and the corresponding page level access controls have to be mapped to them. This will allow the product to hide or show certain menu items and links to users depending on the tenant context and the packages enabled for that tenant/ user group.

Usage-Based Quota and Access Control
Many a times tenants are allowed to use the product for a specific no. of users or for a specified quota of usage (For example can do XXX no. of market surveys). These transactions and events have to be metered in the product, and once the defined quota is exceeded, the access control system should deny access to any user belonging to that tenant / user group.

Summary
The Access Control Paradigm of a Multi-tenant Application/ SaaS Product, should enlarge its frame of reference to include extensive customizability and configurability to suit different customers and organizations while still maintaining a single instance and code base.

The engineering stack of a Multi - tenant SaaS product, should have a robust and flexible Access Control layer, so that all the dynamic and run time capabilities are handled at the framework level. The developer then can focus on building the business functions, follow the guidelines provided by the underlying framework and demand a privilege before doing any significant action.

More Stories By Sathiya Rajendhran

Ramkumar is the Founder and Director of Mango DVM, a venture capital funded company in the digital music space, currently going through a third round of funding. He is also the Director of Product Management at Asteor Software Inc, where he was instrumental in incubating and bringing to market two new software products (Techcello & Synergita). He is also the Director of RSR Innovations, a consultancy firm specializing on Strategic Marketing, Innovation and Leadership Development.

Before becoming an entrepreneur, Ramkumar had spent over two decades in various corporates; in functions such as Automation Engineering, Project management, Product management, Marketing and General management.

@ThingsExpo Stories
20th Cloud Expo, taking place June 6-8, 2017, at the Javits Center in New York City, NY, will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud strategy.
Internet-of-Things discussions can end up either going down the consumer gadget rabbit hole or focused on the sort of data logging that industrial manufacturers have been doing forever. However, in fact, companies today are already using IoT data both to optimize their operational technology and to improve the experience of customer interactions in novel ways. In his session at @ThingsExpo, Gordon Haff, Red Hat Technology Evangelist, will share examples from a wide range of industries – includin...
WebRTC is the future of browser-to-browser communications, and continues to make inroads into the traditional, difficult, plug-in web communications world. The 6th WebRTC Summit continues our tradition of delivering the latest and greatest presentations within the world of WebRTC. Topics include voice calling, video chat, P2P file sharing, and use cases that have already leveraged the power and convenience of WebRTC.
"We build IoT infrastructure products - when you have to integrate different devices, different systems and cloud you have to build an application to do that but we eliminate the need to build an application. Our products can integrate any device, any system, any cloud regardless of protocol," explained Peter Jung, Chief Product Officer at Pulzze Systems, in this SYS-CON.tv interview at @ThingsExpo, held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.
Data is the fuel that drives the machine learning algorithmic engines and ultimately provides the business value. In his session at 20th Cloud Expo, Ed Featherston, director/senior enterprise architect at Collaborative Consulting, will discuss the key considerations around quality, volume, timeliness, and pedigree that must be dealt with in order to properly fuel that engine.
"Once customers get a year into their IoT deployments, they start to realize that they may have been shortsighted in the ways they built out their deployment and the key thing I see a lot of people looking at is - how can I take equipment data, pull it back in an IoT solution and show it in a dashboard," stated Dave McCarthy, Director of Products at Bsquare Corporation, in this SYS-CON.tv interview at @ThingsExpo, held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.
IoT is rapidly changing the way enterprises are using data to improve business decision-making. In order to derive business value, organizations must unlock insights from the data gathered and then act on these. In their session at @ThingsExpo, Eric Hoffman, Vice President at EastBanc Technologies, and Peter Shashkin, Head of Development Department at EastBanc Technologies, discussed how one organization leveraged IoT, cloud technology and data analysis to improve customer experiences and effici...
Fact is, enterprises have significant legacy voice infrastructure that’s costly to replace with pure IP solutions. How can we bring this analog infrastructure into our shiny new cloud applications? There are proven methods to bind both legacy voice applications and traditional PSTN audio into cloud-based applications and services at a carrier scale. Some of the most successful implementations leverage WebRTC, WebSockets, SIP and other open source technologies. In his session at @ThingsExpo, Da...
"IoT is going to be a huge industry with a lot of value for end users, for industries, for consumers, for manufacturers. How can we use cloud to effectively manage IoT applications," stated Ian Khan, Innovation & Marketing Manager at Solgeniakhela, in this SYS-CON.tv interview at @ThingsExpo, held November 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA.
As data explodes in quantity, importance and from new sources, the need for managing and protecting data residing across physical, virtual, and cloud environments grow with it. Managing data includes protecting it, indexing and classifying it for true, long-term management, compliance and E-Discovery. Commvault can ensure this with a single pane of glass solution – whether in a private cloud, a Service Provider delivered public cloud or a hybrid cloud environment – across the heterogeneous enter...
The cloud promises new levels of agility and cost-savings for Big Data, data warehousing and analytics. But it’s challenging to understand all the options – from IaaS and PaaS to newer services like HaaS (Hadoop as a Service) and BDaaS (Big Data as a Service). In her session at @BigDataExpo at @ThingsExpo, Hannah Smalltree, a director at Cazena, provided an educational overview of emerging “as-a-service” options for Big Data in the cloud. This is critical background for IT and data professionals...
@GonzalezCarmen has been ranked the Number One Influencer and @ThingsExpo has been named the Number One Brand in the “M2M 2016: Top 100 Influencers and Brands” by Onalytica. Onalytica analyzed tweets over the last 6 months mentioning the keywords M2M OR “Machine to Machine.” They then identified the top 100 most influential brands and individuals leading the discussion on Twitter.
Today we can collect lots and lots of performance data. We build beautiful dashboards and even have fancy query languages to access and transform the data. Still performance data is a secret language only a couple of people understand. The more business becomes digital the more stakeholders are interested in this data including how it relates to business. Some of these people have never used a monitoring tool before. They have a question on their mind like “How is my application doing” but no id...
What happens when the different parts of a vehicle become smarter than the vehicle itself? As we move toward the era of smart everything, hundreds of entities in a vehicle that communicate with each other, the vehicle and external systems create a need for identity orchestration so that all entities work as a conglomerate. Much like an orchestra without a conductor, without the ability to secure, control, and connect the link between a vehicle’s head unit, devices, and systems and to manage the ...
More and more brands have jumped on the IoT bandwagon. We have an excess of wearables – activity trackers, smartwatches, smart glasses and sneakers, and more that track seemingly endless datapoints. However, most consumers have no idea what “IoT” means. Creating more wearables that track data shouldn't be the aim of brands; delivering meaningful, tangible relevance to their users should be. We're in a period in which the IoT pendulum is still swinging. Initially, it swung toward "smart for smar...
In an era of historic innovation fueled by unprecedented access to data and technology, the low cost and risk of entering new markets has leveled the playing field for business. Today, any ambitious innovator can easily introduce a new application or product that can reinvent business models and transform the client experience. In their Day 2 Keynote at 19th Cloud Expo, Mercer Rowe, IBM Vice President of Strategic Alliances, and Raejeanne Skillern, Intel Vice President of Data Center Group and G...
Information technology is an industry that has always experienced change, and the dramatic change sweeping across the industry today could not be truthfully described as the first time we've seen such widespread change impacting customer investments. However, the rate of the change, and the potential outcomes from today's digital transformation has the distinct potential to separate the industry into two camps: Organizations that see the change coming, embrace it, and successful leverage it; and...
With major technology companies and startups seriously embracing IoT strategies, now is the perfect time to attend @ThingsExpo 2016 in New York. Learn what is going on, contribute to the discussions, and ensure that your enterprise is as "IoT-Ready" as it can be! Internet of @ThingsExpo, taking place June 6-8, 2017, at the Javits Center in New York City, New York, is co-located with 20th Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry p...
20th Cloud Expo, taking place June 6-8, 2017, at the Javits Center in New York City, NY, will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud strategy.
Internet of @ThingsExpo, taking place June 6-8, 2017 at the Javits Center in New York City, New York, is co-located with the 20th International Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. @ThingsExpo New York Call for Papers is now open.