Cookie based state propagation for a multi-tenant identity cloud service

Patent metadata

Field	Value
Publication number	US-10445395-B2
Application number	US-201715701968-A
Country	US
Kind code	B2
Filing date	Sep 12, 2017
Priority date	Sep 16, 2016
Publication date	Oct 15, 2019
Grant date	Oct 15, 2019

Abstract

A system that provides cloud based identity management, at a first microservice, saves a current state on a cookie that is stored on a browser, where the current state is saved in a format specific to the first microservice. The system performs an operation on the first microservice that generates a first portion of information and a second portion of information. The system stores the first portion of information related to the operation on the cookie, the first portion including the current state. The system provides a second portion of information related to the operation to a second microservice as a query parameter on a redirect Uniform Resource Locator (“URL”), where the second portion is removed from the cookie.

First claim

What is claimed is:

1. A non-transitory computer readable medium having instructions stored thereon that, when executed by a processor, cause the processor to provide cloud based identity management, the providing comprising:
at a first microservice, saving a current state on a cookie that is stored on a browser, wherein the current state is saved in a format specific to the first microservice;
performing an operation, on the first microservice, that generates a first portion of information and a second portion of information;
storing the first portion of information, related to the operation, on the cookie, the first portion comprising the current state; and
providing a second portion of information, related to the operation, to a second microservice as a query parameter on a redirect Uniform Resource Locator (URL), wherein the second portion is removed from the cookie.

2. The non-transitory computer readable medium of claim 1 , wherein the first microservice is a Single Sign On (SSO) microservice and the second microservice is a Security Assertion Markup Language (SAML) microservice.

3. The non-transitory computer readable medium of claim 2 , wherein the operation is an authentication function, wherein the second portion of information comprises a result of the authentication function.

4. The non-transitory computer readable medium of claim 3 , wherein the result of the authentication function is provided by the query parameter.

5. The non-transitory computer readable medium of claim 1 , wherein the format specific to the first microservice cannot be read by other microservices.

6. The non-transitory computer readable medium of claim 1 , the providing further comprising a request cookie for authentication requests and a session cookie for microservice states.

7. The non-transitory computer readable medium of claim 6 , wherein the request cookie and the session cookie are each encrypted with keys that are changed on a predetermined time period.

8. A system for providing cloud based identity and access management, comprising:
a plurality of tenants;
a plurality of microservices; and
one or more processors that:
at a first microservice, save a current state on a cookie that is stored on a browser, wherein the current state is saved in a format specific to the first microservice;
perform an operation, on the first microservice, that generates a first portion of information and a second portion of information;
store the first portion of information, related to the operation, on the cookie, the first portion comprising the current state; and
provide a second portion of information, related to the operation, to a second microservice as a query parameter on a redirect Uniform Resource Locator (URL), wherein the second portion is removed from the cookie.

9. The system of claim 8 , wherein the first microservice is a Single Sign On (SSO) microservice and the second microservice is a Security Assertion Markup Language (SAML) microservice.

10. The system of claim 9 , wherein the operation is an authentication function, wherein the second portion of information comprises a result of the authentication function.

11. The system of claim 10 , wherein the result of the authentication function is provided by the query parameter.

12. The system of claim 8 , wherein the format specific to the first microservice cannot be read by other microservices.

13. The system of claim 8 , the processors further generating a request cookie for authentication requests and a session cookie for microservice states.

14. The system of claim 13 , wherein the request cookie and the session cookie are each encrypted with keys that are changed on a predetermined time period.

15. A method of providing cloud based identity management, the method comprising:
at a first microservice, saving a current state on a cookie that is stored on a browser, wherein the current state is saved in a format specific to the first microservice;
performing an operation, on the first microservice, that generates a first portion of information and a second portion of information;
storing the first portion of information, related to the operation, on the cookie, the first portion comprising the current state; and
providing a second portion of information, related to the operation, to a second microservice as a query parameter on a redirect Uniform Resource Locator (URL), wherein the second portion is removed from the cookie.

16. The method of claim 15 , wherein the first microservice is a Single Sign On (SSO) microservice and the second microservice is a Security Assertion Markup Language (SAML) microservice.

17. The method of claim 16 , wherein the operation is an authentication function, wherein the second portion of information comprises a result of the authentication function.

18. The method of claim 17 , wherein the result of the authentication function is provided by the query parameter.

19. The method of claim 15 , wherein the format specific to the first microservice cannot be read by other microservices.

20. The method of claim 15 , further comprising a request cookie for authentication requests and a session cookie for microservice states.

Assignees

• Oracle Int Corp

Inventors

• Carru Damien
• Uchil Mrudul P
• SANKESARA Bhavik
• Xia Risheng

Classifications

• H04L63/0815

  providing single-sign-on or federations · CPC title

• G06F16/957

  Browsing optimisation, e.g. caching or content distillation · CPC title

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• G06F16/9574 Primary

  of access to content, e.g. by caching · CPC title

• G06F16/9566

  URL specific, e.g. using aliases, detecting broken or misspelled links · CPC title