Abstract: Cross-service usage is dynamically enforced for different network-based services. A cross-service control system may accept requests to specify a usage quota for a client for an interface of a network-based service. A rule to enforce the usage quota may be distributed to request handling nodes for the service. Usage measurements may be collected from the request handling nodes for requests received from the client via the interface. An update to the usage quota may be determined from an evaluation of the usage measurements. The rule at the request handling nodes may be updated to enforce the updated usage quota.

Abstract: Example embodiments provide for a system configured to provide constrained delegation and connection pooling for a back-end server by providing a variable identity pipe between it and a front-end server. A client will authenticate to the front-end process using credentials that are typically non-delegable by default, e.g., a token, certificate, or the like. The front-end is configured to extract client identity information and use this information to request changing an identity associated with the variable identity pipe. In addition, requests for actions on resources received from the client can be transformed into remote procedural calls and used by the back-end server to process the requests. A response is then sent back over the variable identity pipe to the client via the front-end server. The variable identity pipe is left open to allow other requests from other clients to be sent over the variable identity pipe in a similar manner.

Abstract: Example embodiments provide for a system configured to provide constrained delegation and connection pooling for a back-end server by providing a variable identity pipe between it and a front-end server. A client will authenticate to the front-end process using credentials that are typically non-delegable by default, e.g., a token, certificate, or the like. The front-end is configured to extract client identity information and use this information to request changing an identity associated with the variable identity pipe. In addition, requests for actions on resources received from the client can be transformed into remote procedural calls and used by the back-end server to process the requests. A response is then sent back over the variable identity pipe to the client via the front-end server. The variable identity pipe is left open to allow other requests from other clients to be sent over the variable identity pipe in a similar manner.

Abstract: Example embodiments provide for a system configured to provide constrained delegation and connection pooling for a back-end server by providing a variable identity pipe between it and a front-end server. A client will authenticate to the front-end process using credentials that are typically non-delegable by default, e.g., a token, certificate, or the like. The front-end is configured to extract client identity information and use this information to request changing an identity associated with the variable identity pipe. In addition, requests for actions on resources received from the client can be transformed into remote procedural calls and used by the back-end server to process the requests. A response is then sent back over the variable identity pipe to the client via the front-end server. The variable identity pipe is left open to allow other requests from other clients to be sent over the variable identity pipe in a similar manner.

Abstract: Embodiments provide for a sub-pub architecture that is independent of the number of subscriptions by neither evaluating, nor storing the results of, each event against each subscription. Instead, a canonical subscription is determined a priori, which includes a superset of common property filters for similar events. Properties of events happening in a data store are evaluated against this canonical subscription and the results are stored typically once as event records. When a subscription registrar requests notification of events that match a subscription's filter criteria, only the subset of event records corresponding to the appropriate superset of common properties are evaluated against the subscription. Other embodiments also include methods, systems, and computer program products for determining the subset of event records to be compared against a subscription's filter criteria, while ensuring that out of sequence, uncommitted events are not lost.