Overcoming Access Control Challenges for Multi-tenant Applications- Aserto
Overcoming access control challenges
Authorization poses a unique challenge for multi-tenant applications. It's in the critical path of every application request, so it has to make decisions with minimum latency and maximum availability. This guide teaches you how to overcome these challenges by:
- Extracting policy logic from application code
- Applying the principle of least privilege
- Enforcing locally against real-time data
- Centrally managing policies and decision logs
Get the guide
Easily add fine-grained, policy-based, real-time access control to your cloud applications and APIs.
Fine-grained, policy-based access control
Grant access to your applications based on your user attributes, resource hierarchy, and relationships between them.
allowed {
ns := time.now_ns()
day := time.weekday(ns)
day == data.workdays[_]
}
Include environmental attributes in your policies
allowed {
input.user.properties.dept == "Sales"
}
Use any user-centric attributes in your policies
allowed {
ds.check({
"subject_type": "user",
"subject_id": input.user.id,
"relation": "manager",
"object_type": "user",
"object_id": input.resource.id
})
}
Make access decisions based on org-chart relationships
allowed {
ds.check({
"subject_type": "user",
"subject_id": input.user.id,
"relation": "can_read",
"object_type": "document",
"object_id": input.resource.id
})
}
Model your resource hierarchy and enforce fine-grained authorization
allowed {
ns := time.now_ns()
day := time.weekday(ns)
day == data.workdays[_]
}
Include environmental attributes in your policies
- 1
- 2
- 3
- 4
Enforce in milliseconds
Make authorization decisions in milliseconds against real-time user attributes and resource data.
Centralized policy management
Define and manage all of your policies from one central location.
Policy lifecycle management
Extract policy from application code and convert it to immutable images that can be signed, verified, and versioned.