Technologies for securely extending cloud service apis in a cloud service marketplace

Abstract

Technologies for securely extending cloud service application programming interfaces (APIs) in a cloud service marketplace include a connector hub of a marketplace computing device communicatively coupled to a cloud service provider interface of a cloud service provider and a cloud service broker interface of a cloud service broker. The connector hub is configured to deploy an API connector instance in a connection factory of the marketplace computing device, transmit provider provisioning channel credentials to the API connector instance and the cloud service provider interface and transmit broker provisioning channel credentials to the API connector instance and the cloud service broker interface. The connector hub is additionally configured establish a provisioning channel between the cloud service provider interface and the cloud service broker interface. Additional embodiments are described herein.

What is claimed is: 
     
         1 . A method for securely extending cloud service application programming interfaces (APIs) in a cloud service marketplace, the method comprising:
 deploying, by a connector hub of a marketplace computing device, an API connector instance in a connection factory of the marketplace computing device, wherein the API connector instance comprises source code of an API connector usable to communicate with a remote API associated with a cloud service of the cloud service provider;   transmitting, by the connector hub, provider provisioning channel credentials to the API connector instance and a cloud service provider interface of the cloud service provider;   transmitting, by the connector hub, broker provisioning channel credentials to the API connector instance and a cloud service broker interface of the cloud service broker; and   establishing, by the connector hub, a provisioning channel between the cloud service provider interface and the cloud service broker interface, wherein establishing the provisioning channel comprises establishing (i) a first communication channel between the API connector instance and the cloud service provider interface using the provider provisioning channel credentials to perform a first authentication operation, and (ii) a second communication channel between the API connector instance and the cloud service broker interface using the broker provisioning channel credentials to perform a second authentication operation.   
     
     
         2 . The method of  claim 1 , further comprising:
 generating, by the connector hub, proxy provisioning channel credentials;   deploying, by the connector hub, an authentication proxy instance in the connection factory; and   transmitting, by the connector hub, the proxy provisioning channel credentials to the API connector instance and the authentication proxy instance,   wherein establishing the provisioning channel between the cloud service provider interface and the cloud service broker interface comprises establishing (i) a first communication channel between the API connector instance and the cloud service provider interface by using the provider provisioning channel credentials to perform a first authentication operation, (ii) a second communication channel between the authentication proxy instance and the cloud service broker interface by using the broker provisioning channel credentials to perform a second authentication operation, and (iii) a third communication channel between the API connector instance and the authentication proxy instance by using the proxy provisioning channel credentials to perform a third authentication operation.   
     
     
         3 . The method of  claim 1 , wherein establishing the second communication channel between the authentication proxy instance and the cloud service broker interface includes transmitting an address of the authentication proxy instance to the cloud service broker interface, wherein the address is usable by the cloud service broker interface to initiate communications with the authentication proxy instance. 
     
     
         4 . The method of  claim 1 , further comprising:
 generating, by the connector hub, the provider provisioning channel credentials corresponding to the cloud service provider; and   generating, by the connector hub, the broker provisioning channel credentials corresponding to the cloud service broker.   
     
     
         5 . The method of  claim 4 , further comprising receiving, by the connector hub, an API connector provision notification from a cloud service broker marketplace of the marketplace computing device, wherein generating the broker provisioning channel credentials for the cloud service broker comprises generating the broker provisioning channel credentials in response to having received the API connector provision notification. 
     
     
         6 . The method of  claim 4 , further comprising receiving, by the connector hub, an indication from the cloud service provider that a new cloud service of the cloud service provider has been made available in the cloud service broker marketplace, wherein generating the provider provisioning channel credentials comprises generating the provider provisioning channel credentials in response to having received the indication. 
     
     
         7 . The method of  claim 4 , further comprising:
 storing, by the connector hub, the provider provisioning channel credentials in a credentials database of the connector hub;   associating, by the connector hub, the provider provisioning channel credentials with the cloud service provider in the credentials database;   storing, by the connector hub, the broker provisioning channel credentials in the credentials database in the credentials database; and   associating, by the connector hub, the broker provisioning channel credentials with a cloud service broker.   
     
     
         8 . The method of  claim 1 , wherein establishing the second communication channel between the API connector instance and the cloud service broker interface includes transmitting an address of the API connector instance to the cloud service broker interface, wherein the address is usable by the cloud service broker interface to initiate communications with the authentication proxy instance. 
     
     
         9 . One or more computer-readable storage media comprising a plurality of instructions stored thereon that in response to being executed cause a connector hub of a marketplace computing device to:
 deploy an API connector instance in a connection factory of the marketplace computing device, wherein the API connector instance comprises source code of an API connector usable to communicate with a remote API associated with a cloud service of the cloud service provider;   transmit provider provisioning channel credentials to the API connector instance and a cloud service provider interface of the cloud service provider;   transmit broker provisioning channel credentials to the API connector instance and a cloud service broker interface of the cloud service broker; and   establish a provisioning channel between the cloud service provider interface and the cloud service broker interface, wherein to establish the provisioning channel comprises to establish (i) a first communication channel between the API connector instance and the cloud service provider interface using the provider provisioning channel credentials to perform a first authentication operation, and (ii) a second communication channel between the API connector instance and the cloud service broker interface using the broker provisioning channel credentials to perform a second authentication operation.   
     
     
         10 . The one or more computer-readable storage media of  claim 9 , wherein the plurality of instructions further cause the connector hub to:
 generate proxy provisioning channel credentials;   deploy an authentication proxy instance in the connection factory; and   transmit the proxy provisioning channel credentials to the API connector instance and the authentication proxy instance,   wherein to establish the provisioning channel between the cloud service provider interface and the cloud service broker interface comprises to establish (i) a first communication channel between the API connector instance and the cloud service provider interface by using the provider provisioning channel credentials to perform a first authentication operation, (ii) a second communication channel between the authentication proxy instance and the cloud service broker interface by using the broker provisioning channel credentials to perform a second authentication operation, and (iii) a third communication channel between the API connector instance and the authentication proxy instance by using the proxy provisioning channel credentials to perform a third authentication operation.   
     
     
         11 . The one or more computer-readable storage media of  claim 9 , wherein to establish the second communication channel between the authentication proxy instance and the cloud service broker interface includes to transmit an address of the authentication proxy instance to the cloud service broker interface, wherein the address is usable by the cloud service broker interface to initiate communications with the authentication proxy instance. 
     
     
         12 . The one or more computer-readable storage media of  claim 9 , wherein the plurality of instructions further cause the connector hub to:
 generate the provider provisioning channel credentials corresponding to the cloud service provider; and   generate the broker provisioning channel credentials corresponding to the cloud service broker.   
     
     
         13 . The one or more computer-readable storage media of  claim 12 , wherein the plurality of instructions further cause the connector hub to receive an API connector provision notification from a cloud service broker marketplace of the marketplace computing device, wherein to generate the broker provisioning channel credentials for the cloud service broker comprises to generate the broker provisioning channel credentials in response to having received the API connector provision notification. 
     
     
         14 . The one or more computer-readable storage media of  claim 12 , wherein the plurality of instructions further cause the connector hub to receive an indication from the cloud service provider that a new cloud service of the cloud service provider has been made available in the cloud service broker marketplace, wherein to generate the provider provisioning channel credentials comprises to generate the provider provisioning channel credentials in response to having received the indication. 
     
     
         15 . The one or more computer-readable storage media of  claim 12 , wherein the plurality of instructions further cause the connector hub to:
 store the provider provisioning channel credentials in a credentials database of the connector hub;   associate the provider provisioning channel credentials with the cloud service provider in the credentials database;   store the broker provisioning channel credentials in the credentials database in the credentials database; and   associate the broker provisioning channel credentials with a cloud service broker.   
     
     
         16 . The one or more computer-readable storage media of  claim 9 , wherein to establish the second communication channel between the API connector instance and the cloud service broker interface includes to transmit an address of the API connector instance to the cloud service broker interface, wherein the address is usable by the cloud service broker interface to initiate communications with the authentication proxy instance. 
     
     
         17 . A connector hub of a marketplace computing device for securely extending cloud service application programming interfaces (APIs) in a cloud service marketplace, wherein the cloud service marketplace includes a marketplace computing device, the marketplace computing device comprising:
 a CPU; and   a memory having stored therein a plurality of instructions that when executed by the processor cause a connector hub of the marketplace computing device to:
 deploy an API connector instance in a connection factory of the marketplace computing device, wherein the API connector instance comprises source code of an API connector usable to communicate with a remote API associated with a cloud service of the cloud service provider; 
 transmit provider provisioning channel credentials to the API connector instance and a cloud service provider interface of the cloud service provider; 
 transmit broker provisioning channel credentials to the API connector instance and a cloud service broker interface of the cloud service broker; and 
 establish a provisioning channel between the cloud service provider interface and the cloud service broker interface, wherein to establish the provisioning channel comprises to establish (i) a first communication channel between the API connector instance and the cloud service provider interface using the provider provisioning channel credentials to perform a first authentication operation, and (ii) a second communication channel between the API connector instance and the cloud service broker interface using the broker provisioning channel credentials to perform a second authentication operation. 
   
     
     
         18 . The marketplace computing device of  claim 17 , wherein the one or more processors are further configured to execute the instructions to:
 generate proxy provisioning channel credentials;   deploy an authentication proxy instance in the connection factory; and   transmit the proxy provisioning channel credentials to the API connector instance and the authentication proxy instance,   wherein to establish the provisioning channel between the cloud service provider interface and the cloud service broker interface comprises to establish (i) a first communication channel between the API connector instance and the cloud service provider interface by using the provider provisioning channel credentials to perform a first authentication operation, (ii) a second communication channel between the authentication proxy instance and the cloud service broker interface by using the broker provisioning channel credentials to perform a second authentication operation, and (iii) a third communication channel between the API connector instance and the authentication proxy instance by using the proxy provisioning channel credentials to perform a third authentication operation.   
     
     
         19 . The marketplace computing device of  claim 17 , wherein to establish the second communication channel between the authentication proxy instance and the cloud service broker interface includes to transmit an address of the authentication proxy instance to the cloud service broker interface, wherein the address is usable by the cloud service broker interface to initiate communications with the authentication proxy instance. 
     
     
         20 . The marketplace computing device of  claim 17 , wherein the one or more processors are further configured to execute the instructions to:
 generate the provider provisioning channel credentials corresponding to the cloud service provider; and   generate the broker provisioning channel credentials corresponding to the cloud service broker.   
     
     
         21 . The marketplace computing device of  claim 20 , wherein the one or more processors are further configured to execute the instructions to receive an API connector provision notification from a cloud service broker marketplace of the marketplace computing device, wherein to generate the broker provisioning channel credentials for the cloud service broker comprises to generate the broker provisioning channel credentials in response to having received the API connector provision notification. 
     
     
         22 . The marketplace computing device of  claim 20 , wherein the one or more processors are further configured to execute the instructions to receive an indication from the cloud service provider that a new cloud service of the cloud service provider has been made available in the cloud service broker marketplace, wherein to generate the provider provisioning channel credentials comprises to generate the provider provisioning channel credentials in response to having received the indication. 
     
     
         23 . The marketplace computing device of  claim 20 , wherein the one or more processors are further configured to execute the instructions to:
 store the provider provisioning channel credentials in a credentials database of the connector hub;   associate the provider provisioning channel credentials with the cloud service provider in the credentials database;   store the broker provisioning channel credentials in the credentials database in the credentials database; and   associate the broker provisioning channel credentials with a cloud service broker.   
     
     
         24 . The marketplace computing device of  claim 17 , wherein to establish the second communication channel between the API connector instance and the cloud service broker interface includes to transmit an address of the API connector instance to the cloud service broker interface, wherein the address is usable by the cloud service broker interface to initiate communications with the authentication proxy instance.