Remote execution using a global identity

Patent metadata

Field	Value
Publication number	US-12120189-B2
Application number	US-202318497720-A
Country	US
Kind code	B2
Filing date	Oct 30, 2023
Priority date	Jul 17, 2020
Publication date	Oct 15, 2024
Grant date	Oct 15, 2024

Abstract

Embodiments of the present disclosure may provide a streamlined process for performing operations, such as data sharing and data replication, using multiple accounts. A global identity (also referred to as an organization user) may be employed, where the global identity may have access to multiple accounts across the same or different deployments. The global identity may switch between accounts from its login session and perform various tasks in the context of different accounts without undergoing further authentication.

First claim

What is claimed is:

1. A method comprising:
establishing, at a first deployment, a session pool for a login session for a user providing access to a plurality of accounts associated with an organization based on a global identity;
providing, using the session pool, a first remote session with a first remote session ID using a first proxy user associated with the user for the first remote session;
providing, using the session pool, a second remote session with a second remote session ID using a second proxy user associated with the user for the second remote session;
receiving, in the session pool, a first selection for the first remote session;
transmitting, from the first deployment, a first execution request to a second deployment associated with the first remote session, the second deployment being configured to execute the first execution request in context of the first proxy user;
receiving, in the session pool, a second selection for the second remote session; and
transmitting, from the first deployment, a second execution request to a third deployment associated with the second remote session, the third deployment being configured to execute the second execution request in context of the second proxy user.

2. The method of claim 1 , further comprising:
receiving, from the second deployment, a first result based on the first execution request; and
receiving, from a third deployment, a second result based on the second execution request.

3. The method of claim 2 , further comprising:
combining the first and second results to generate a final result.

4. The method of claim 2 , wherein receiving the first result includes retrieving the first result from a cloud storage location.

5. The method of claim 1 , further comprising:
authenticating a one-way trust relationship associated with the global identity,
wherein the login session provides access to the plurality of accounts without further authentication.

6. The method of claim 5 , wherein the authenticating is performed using a single sign-on token.

7. The method of claim 1 , wherein at least one property value of the first proxy user indicates that that the first proxy user is standing in for the global identity.

8. A system comprising:
one or more processors of a machine; and
at least one memory storing instructions that, when executed by the one or more processors, cause the machine to perform operations comprising:
establishing, at a first deployment, a session pool for a login session for a user providing access to a plurality of accounts associated with an organization based on a global identity;
providing, using the session pool, a first remote session with a first remote session ID using a first proxy user associated with the user for the first remote session;
providing, using the session pool, a second remote session with a second remote session ID using a second proxy user associated with the user for the second remote session;
receiving, in the session pool, a first selection for the first remote session;
transmitting, from the first deployment, a first execution request to a second deployment associated with the first remote session, the second deployment being configured to execute the first execution request in context of the first proxy user;
receiving, in the session pool, a second selection for the second remote session; and
transmitting, from the first deployment, a second execution request to a third deployment associated with the second remote session, the third deployment being configured to execute the second execution request in context of the second proxy user.

9. The system of claim 8 , the operations further comprising:
receiving, from the second deployment, a first result based on the first execution request; and
receiving, from a third deployment, a second result based on the second execution request.

10. The system of claim 9 , further comprising:
combining the first and second results to generate a final result.

11. The system of claim 9 , wherein receiving the first result includes retrieving the first result from a cloud storage location.

12. The system of claim 8 , the operations further comprising:
authenticating a one-way trust relationship associated with the global identity,
wherein the login session provides access to the plurality of accounts without further authentication.

13. The system of claim 12 , wherein the authenticating is performed using a single sign-on token.

14. The system of claim 8 , wherein at least one property value of the first proxy user indicates that that the first proxy user is standing in for the global identity.

15. A non-transitory computer readable storage media storing instructions that, when executed by one or more processors, cause the one or more processors to:
establishing, at a first deployment, a session pool for a login session for a user providing access to a plurality of accounts associated with an organization based on a global identity;
providing, using the session pool, a first remote session with a first remote session ID using a first proxy user associated with the user for the first remote session;
providing, using the session pool, a second remote session with a second remote session ID using a second proxy user associated with the user for the second remote session;
receiving, in the session pool, a first selection for the first remote session;
transmitting, from the first deployment, a first execution request to a second deployment associated with the first remote session, the second deployment being configured to execute the first execution request in context of the first proxy user;
receiving, in the session pool, a second selection for the second remote session; and
transmitting, from the first deployment, a second execution request to a third deployment associated with the second remote session, the third deployment being configured to execute the second execution request in context of the second proxy user.

16. The non-transitory computer readable storage media of claim 15 , further comprising:
receiving, from the second deployment, a first result based on the first execution request; and
receiving, from a third deployment, a second result based on the second execution request.

17. The non-transitory computer readable storage media of claim 16 , further comprising:
combining the first and second results to generate a final result.

18. The non-transitory computer readable storage media of claim 16 , wherein receiving the first result includes retrieving the first result from a cloud storage location.

19. The non-transitory computer readable storage media of claim 15 , further comprising:
authenticating a one-way trust relationship associated with the global identity,
wherein the login session provides access to the plurality of accounts without further authentication.

20. The non-transitory computer readable storage media of claim 19 , wherein the authenticating is performed using a single sign-on token.

21. The non-transitory computer readable storage media of claim 15 , wherein at least one property value of the first proxy user indicates that that the first proxy user is standing in for the global identity.

Assignees

• Snowflake Inc

Inventors

• Bijon Khalid Zaman
• Carru Damien
• Child Christopher Peter
• Karlson Eric
• Mi Zheng

Classifications

• H04L67/60

  Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources (admission control or resource allocation H04L47/70) · CPC title

• H04L67/59

  Providing operational support to end devices by off-loading in the network or by emulation, e.g. when they are unavailable · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04L67/1097

  for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] · CPC title

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title