Abstract: A ticketing system adapted for use with a cloud-based services platform is provided by a ticket-based authorization model in which the authorization requirements for traversing one or more meshes of resources associated with a cloud service are annotated in links included in a resource that refer to other resources. The meshes are thus self-describing with respect to the association among the resources (i.e., the links) as well as the authorization required to access resources. Resource access requires a principal ticket which asserts that a caller at a client (e.g., a security principal representing a device or identity associated with a user) is authenticated, plus zero or more claim tickets. The claim tickets make additional assertions about the caller that the cloud service may use to check that the caller is authorized to access the resource.

Abstract: Described are embodiments directed to processing write requests using designated servers with global knowledge of information within a distributed system. The designated servers are used to enforce a data rule that limits the data that may be written to the distributed system. In order to ensure that data written to the distributed system is consistent with the data rule, when another server within the distributed system receives a request to write information that is subject to the data rule, it must consult with one of the designated servers before it can accept the write request. If the designated server determines that the data is consistent with the data rule, the write request is approved. Otherwise, the write request is denied.

Abstract: A ticketing system adapted for use with a cloud-based services platform is provided by a ticket-based authorization model in which the authorization requirements for traversing one or more meshes of resources associated with a cloud service are annotated in links included in a resource that refer to other resources. The meshes are thus self-describing with respect to the association among the resources (i.e., the links) as well as the authorization required to access resources. Resource access requires a principal ticket which asserts that a caller at a client (e.g., a security principal representing a device or identity associated with a user) is authenticated, plus zero or more claim tickets. The claim tickets make additional assertions about the caller that the cloud service may use to check that the caller is authorized to access the resource.

Abstract: In embodiments, servers within a distributed system include more than one thread pool from which threads may be allocated for processing requests received at the servers. The servers have a local thread pool from which threads for processing requests that require only local resources (resources stored locally on the server) are allocated. In embodiments, the server will include a remote thread pool from which threads are allocated for processing requests that require resources stored on any remote server. In other embodiments, the server will include a corresponding thread pool for each of a number of specified remote servers. When a request requires access to resources stored on a particular server, a thread from the corresponding thread pool associated with the particular server will be allocated for processing the request.

Abstract: Described are embodiments directed to processing write requests using designated servers with global knowledge of information within a distributed system. The designated servers are used to enforce a data rule that limits the data that may be written to the distributed system. In order to ensure that data written to the distributed system is consistent with the data rule, when another server within the distributed system receives a request to write information that is subject to the data rule, it must consult with one of the designated servers before it can accept the write request. If the designated server determines that the data is consistent with the data rule, the write request is approved. Otherwise, the write request is denied.