Managing Access to Service Providers in Federated Identity Environments: A Case Study in a Cloud Storage Service

Abstract

Currently the diversity of services, which are adhering to Identity Federation, has raised new challenges in the area. Increasingly, service providers need to control the access to their resources by users from the federation as, even though the user is authenticated by the federation, its access to resources cannot be taken for granted. Each Service Provider (SP) of a federation implements their own access control mechanism. Moreover, SPs might need to allow different access control granularity. For instance, all users from a particular Identity Provider (IdP) may access the resources due to some financial agreement. On the other hand, it might be the case that only specific users, or groups of users, have access to the resources. This paper proposes a solution to this problem through a hierarchical authorization system. Our approach, which can be customized to different SPs, allows the SP administrator to manage which IdPs, or users, have access to the provided resources. In order to demonstrate the feasibility of our approach, we present a case study in the context of a cloud storage solution.

A Survey on Identity and Access Management for Cross-Domain Dynamic Users: Issues, Solutions, and Challenges

“…Several studies have recommended hierarchical user groups because there are multiple groups with varied access types [23], [24], [25]. It can be described in two ways based on various approaches: internally as varied rights within a single group, and externally as different parent-child groupings.…”

“…Diniz et al [25] use a relatively different approach for cloud identity management. A hierarchical access control model underpins the suggested method.…”