Systems and methods for accessing cloud resources from a local development environment

Patent metadata

Field	Value
Publication number	US-12309158-B2
Application number	US-202418433231-A
Country	US
Kind code	B2
Filing date	Feb 5, 2024
Priority date	Sep 1, 2017
Publication date	May 20, 2025
Grant date	May 20, 2025

Abstract

A method for accessing cloud resources via a local application development environment on a computing device. The method includes invoking an access management client at the computing device; obtaining an account identifier associated with a user account and communicating the account identifier to an identity platform; receiving an authentication message from the identity platform in response to the identity platform validating the account identifier, the authentication message comprising a role identifier; communicating the authentication message to the cloud platform; receiving security credentials associated with the role identifier from the cloud platform in response to the cloud platform validating the authentication message and the associated role identifier; setting a variable in the local development environment based on the received security credentials for use by the local development environment to request access to one or more resources maintained by the cloud platform.

First claim

The invention claimed is:

1. A method for authorizing access to a set of cloud-based services of a cloud platform, the method comprising, by:
obtaining an account identifier associated with a user account for a user of the cloud platform;
transmitting, to an identity platform, a first authentication message requesting security credentials for the user, the first authentication message including a role identifier managed by the cloud platform, and the identity platform being separate from the cloud platform and managed by an entity different than an entity managing the cloud platform;
in response to the first authentication message being validated, receiving the security credentials from the cloud platform;
storing the security credentials at an access management client;
using the security credentials to access one or more resources maintained by the cloud platform;
determining whether a predetermined period of time has expired;
in response to determining that the predetermined period of time has expired, refreshing the security credentials by:
obtaining the account identifier associated with the user account;
communicating the account identifier to the identity platform;
receiving a second authentication message from the identity platform;
in response to receiving the second authentication message, communicating the second authentication message to the cloud platform along with the role identifier; and
in response to communicating the second authentication message to the cloud platform, receiving new security credentials associated with the role identifier from the cloud platform; and

using the new security credentials to access the one or more resources maintained by the cloud platform.

2. The method of claim 1 , further comprising:
replicating at least a portion of a cloud-based environment on a client device associated with the access management client in accordance with content permissions corresponding to the role identifier received from the client device.

3. The method of claim 1 , wherein:
the security credentials received from the identity platform include an expiration timestamp for the security credentials; and
determining whether the predetermined period of time has expired comprises identifying that a time indicated by the expiration timestamp has passed.

4. The method of claim 1 , wherein refreshing the security credentials comprises:
automatically refreshing the security credentials after the predetermined period of time.

5. The method of claim 1 , wherein the security credentials being validated comprises comparing a first authentication token provided in the security credentials with a second authentication token stored at the cloud platform.

6. The method of claim 1 , wherein using the new security credentials to access the one or more resources maintained by the cloud platform comprises:
setting a variable in a local development environment based on the new security credentials for use by the local development environment to request access to the one or more resources maintained by the cloud platform.

7. The method of claim 1 , wherein the account identifier is at least one of user credentials or a session identifier identifying a pre-existing session between the user account and the identity platform.

8. A method for authorizing access to a set of cloud-based services of a cloud platform, the method comprising:
providing, to an identity platform, an account identifier associated with a user account for a user of the cloud platform;
receiving, from the identity platform, a first authentication message providing security credentials for the user account, the first authentication message including a role identifier managed by the cloud platform, and the identity platform being separate from the cloud platform and managed by an entity different than an entity managing the cloud platform;
accessing, using the using the security credentials, one or more resources maintained by the cloud platform;
subsequent to accessing the one or more resources and in response to determining that a predetermined period of time has expired, refreshing the security credentials by:
obtaining a second authentication message from the identity platform using the account identifier; and
in response to providing the second authentication message to the cloud platform, obtaining new security credentials associated with the role identifier; and

using the new security credentials to access the one or more resources maintained by the cloud platform.

9. The method of claim 8 , wherein obtaining the second authentication message comprises:
communicating the account identifier to the identity platform; and
in response to the identity platform validating the account identifier, receiving the second authentication message from the identity platform.

10. The method of claim 8 , wherein obtaining the new security credentials comprises:
in response to receiving the second authentication message, communicating the second authentication message to the cloud platform along with the role identifier;
validating, by the cloud platform, the second authentication message and the role identifier;
in response to the second authentication message being validated, generating, by the cloud platform, the new security credentials associated with the role identifier; and
providing the new security credentials to an access management client.

11. The method of claim 8 , wherein using the new security credentials comprises:
replicating at least a portion of a cloud-based environment on a client device associated with an access management client in accordance with content permissions corresponding to the role identifier received from the client device.

12. The method of claim 8 , wherein:
the security credentials received from the identity platform include an expiration timestamp for the security credentials; and
determining whether the predetermined period of time has expired comprises identifying that a time indicated by the expiration timestamp has passed.

13. The method of claim 8 , wherein refreshing the security credentials comprises:
automatically refreshing the security credentials after the predetermined period of time.

14. The method of claim 8 , wherein the security credentials are automatically refreshed upon determining that an expiration timestamp associated with the security credentials has expired.

15. The method of claim 8 , wherein using the new security credentials to access the one or more resources maintained by the cloud platform comprises:
setting a variable in a local development environment based on the new security credentials for use by the local development environment to request access to the one or more resources maintained by the cloud platform.

16. An access management client comprising one or more first processors and one or more non-transitory computer-readable data storage media storing instructions which are programmed and executed using the one or more first processors, to:
obtain an account identifier associated with a user account for a user of a cloud platform;
transmit, to an identity platform, a first authentication message requesting security credentials for the user, the first authentication message including a role identifier managed by the cloud platform, and the identity platform being separate from the cloud platform and managed by an entity different than an entity managing the cloud platform;
in response to the first authentication message being validated, receive the security credentials from the identity platform;
store the se

Assignees

• Atlassian Pty Ltd

Inventors

• Anderson Shane
• Fuller Michael
• Bartlett Ashley

Classifications

• H04L63/0815

  providing single-sign-on or federations · CPC title

• H04L63/068

  using time-dependent keys, e.g. periodically changing keys (cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088) · CPC title

• H04L63/06

  for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08) · CPC title

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• H04L63/102 Primary

  Entity profiles · CPC title