Patent ID: 8336089

Claim:
A method for securing access to a services hosting platform, comprising: receiving, at an authorization handler, a request from a client of a tenant for a first service from among a plurality of services provided by the services hosting platform, the request including a credential of the client, wherein the services hosting platform provides a host infrastructure that is sharable by multiple tenants, including the tenant requesting the first service, and that hosts the plurality of services; determining, at the authorization handler, responsive to the credential of the client, whether the client is authorized for the first service and, if it is determined that the client is authorized for the first service, forwarding a token to the client that enables the client to open a session for the first service with the services hosting platform; wrapping, at the services hosting platform, the token of the client with a host specific platform identifier for the first service to provide a platform security token; forwarding the platform security token to a handler of the first service, wherein the handler of the first service invokes a security service via a security service handler that uses the platform security token to verify that the client has credentials to perform the service on the platform, and selectively performs the first service for the client responsive to the security service indicating that the client has sufficient credentials for receiving the first service, wherein the security service is included among the plurality of services provided by the services hosting platform; and after receiving an indication from the security service that the client has sufficient credentials for receiving the first service, the handler of the first service invoking at least one additional service via an additional service handler from among the plurality of services provided by the services hosting platform, wherein the at least one additional service augments the first service and is selectively invoked in accordance with needs of the first service.