1

I am speculating on the design of a system that allows trusted information exchange between two parties.

Party A:

  • Is a large corporation.
  • Wants to offer access to their employees via a single-sign-on arrangement to materials held by Party B.
  • Employees will have access to only parts of what is made available by Party B.

Party B:

  • Wants to share proprietary information with Party A.
  • Does not entirely trust Party A to not disseminate information beyond authorized users.
  • Does not want to give Party A complete access to all their data.
  • The data in question include a variety of web-resources, files, etc. What Party A does with all this stuff is beyond the scope of the question.

A go-between system (man in the middle, clearing house type of arrangement) needs to audit what Party A does with the information, keep logs of who logged in when, what they looked at, for how long, etc.

What kind of systems arrangement would make sense to ensure that access to Party B's information by Party A only happens when specifically allowed?

Improve this question
4
  • Are you asking how you would build such a system, or looking for a product recommendation? What you have there reads a bit like the introductory paragraph of the requirements of a multi-million dollar software project.
    – Mike Ounsworth
    Commented Aug 21, 2018 at 20:34
  • @MikeOunsworth anything that is pre-built would be great, but I'm more so interested in the conceptual design. I don't need something foolproof, I just seek to understand the mechanics of this better.
    – Ryan
    Commented Aug 21, 2018 at 21:26
  • Have you looked into OAuth2? It's largely a framework for authorization, though I'm not certain if it applies to your use case.
    – Steve Sether
    Commented Aug 21, 2018 at 21:43
  • How does a "clearing house" or middleman help in this situation? Why does it matter whether or not Party A trusts Party B?
    – browly
    Commented Aug 21, 2018 at 23:09

1 Answer 1

Reset to default
1

It sounds like your requirements are:

  • Party B has a wealth of content.
  • Party B would like to grant certain employees of Party A access to certain resources.
  • There are flexible access controls for controlling who has access to what.
  • Party B should be able to modify or revoke any access at any time.

Correct?

Lots of ways to skin this cat, in increasing order of complexity / cost:

  • The dumbest way is to set up a 3rd party document manager. At the simplest end of the spectrum is Google Drive that would give you the access control, and at the high end are enormous content platforms like SalesForce. Moving your content over one page at a time is clearly not ideal for various reasons.

  • See if whatever program the content is currently in has flexible enough access control rules. For example if the content is in Office365 or Confluence then you may be able to get away with giving them O365 accounts, or working with IT to give them network accounts that only have access to Confluence.

  • Look a product built to solve this specific problem. As a shameless plug, Entrust GetAccess is such a product that acts as a firewall / authentication wall, allowing you to specify which users are allowed to access which URLs.

Improve this answer
1
  • I have some more digging to do on how to approach this but your suggestions are helpful. Thanks for the help!
    – Ryan
    Commented Aug 21, 2018 at 22:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .