Organizing permission associated with a cloud customer in a virtual computing infrastructure

摘要

Organizing permissions to authorize a subject to perform an action on an object in a cloud computing environment is described. A plurality of permissions associated with a cloud customer is created. A first set of permissions from the plurality of permissions is associated with one or more objects. Each of the first set of permissions describes an action performed on an object. A second set of permissions from the plurality of permissions is associated with one or more users. Each of the second set of permissions describes an action to be performed by one or more users.

主权项

1. A method of authorizing a subject to perform an action on an object in a cloud computing environment having a plurality of computing nodes, the method comprising:
receiving a request by a user for performing an action in the cloud computing system the request comprising a first key-value pair identifying the action and a second key-value pair identifying the object upon which the action is to be performed; determining, from a plurality of permissions, whether an object permission exists having an identifier that matches the value of the key-value pair in the request identifying the object upon which the action is to be performed, each of the plurality of permissions comprising at least one object permission key-value pair defining a delegation path of permission for the object; determining, from the plurality of permissions, whether a user permission exists for the user making the request to act upon the object, each of the plurality of permissions comprising at least one user permission key-value pair defining a delegation path of permission for the user; authorizing the request based on the object permission and user permission for the action on the object in response to determining that both the object permission and the user permission exist; and denying the request in response to determining that at least one of the object permission or the user permission does not exist.