Abstract: According to one embodiment, a method for performing domain-wide authentication and authorization in a cloud-based environment can comprise receiving, from a third-party service of the cloud-based environment, a request to perform authentication and authorization of a user of the third-party service for accessing a cloud-based storage system of the cloud-based environment. A mapping of the user of the third-party service to a user account of the cloud-based storage system can be generated and one or more tokens for the user of the third-party service can in turn be generated based on the mapping of the user of the third-party service to the user account of the cloud-based storage system. The one or more tokens can provide access to services of the cloud-based storage system. The one or more tokens can be provided to the third-party service.