Service discovery for a multi-tenant identity and data security management cloud service

Patent metadata

Field	Value
Publication number	US-10516672-B2
Application number	US-201715609321-A
Country	US
Kind code	B2
Filing date	May 31, 2017
Priority date	Aug 5, 2016
Publication date	Dec 24, 2019
Grant date	Dec 24, 2019

Abstract

A system provides cloud-based identity and access management. The system receives a request for an identity management service, authenticates the request, and forwards the request to a microservice configured to perform the identity management service, where the microservice is implemented by a microservice virtual machine provisioned by a provisioning framework, and the forwarding is according to routing information configured based on metadata information stored in a registry by the provisioning framework. The system then performs the identity management service by the microservice.

First claim

What is claimed is:

1. A non-transitory computer readable medium having instructions stored thereon that, when executed by a processor, cause the processor to provide cloud-based identity and access management, the providing comprising:
receiving a request for an identity management service;
authenticating the request;
forwarding the request to a first microservice configured to perform the identity management service, the first microservice being at least one of a plurality of microservices implemented by microservice virtual machines that are provisioned by a provisioning framework, wherein
the provisioning framework stores metadata information about the provisioned microservice virtual machines in a registry,
the forwarding is according to routing information configured based on metadata information stored in the registry and is performed in part by a routing tier that discovers routes to the provisioned microservice virtual machines; and
performing the identity management service by the microservice.

2. The computer readable medium of claim 1 , wherein the metadata information identifies a first microservice virtual machine that implements the first microservice.

3. The computer readable medium of claim 1 , wherein the metadata information comprises an internet protocol (IP) address of the first microservice virtual machine that implements the first microservice.

4. The computer readable medium of claim 1 , wherein a service discovery agent (SDA) is implemented as a common code kernel on virtual machines provisioned by the provisioning framework to implement a service node, a cache node, or a routing node, wherein the provisioning framework stores respective metadata information in the registry for implemented virtual machines.

5. The computer readable medium of claim 4 , wherein the metadata information stored in the registry for the microservice virtual machines is used by one or more SDAs on one or more routing nodes in the routing tier to determine the routing information for routing the request.

6. The computer readable medium of claim 5 , wherein a resource related to the identity management task is cached in a remote cache, wherein the provisioning framework provisions cache virtual machines that each implement a cache node in a cache cluster that implements the remote cache, wherein the provisioning framework stores in the registry metadata information for the cache virtual machines.

7. The computer readable medium of claim 6 , wherein the metadata information stored for the cache virtual machines is used by SDAs at cache nodes to form the cache cluster.

8. The computer readable medium of claim 6 , wherein the metadata information stored for the cache virtual machines is used by an SDA at the first microservice to reach the remote cache.

9. The computer readable medium of claim 6 , wherein the first microservice is stateless, wherein the remote cache comprises a distributed data grid, wherein the remote cache and the first microservice are configured to scale independently of one another.

10. The computer readable medium of claim 6 , wherein the remote cache implements a different namespace for each tenant that uses the identity management service.

11. The computer readable medium of claim 1 , wherein the first microservice virtual machine implements the first microservice as an instance of the identity management service.

12. The computer readable medium of claim 1 , wherein the metadata stored in the registry is updated upon a status change of the first microservice or the first microservice virtual machine.

13. The computer readable medium of claim 12 , wherein the status change comprises a node provisioning, a node de-provisioning, a node crash, a node hang, a service crash, a service hang, a service time-out, or a topology change.

14. The computer readable medium of claim 1 , wherein the status change is determined based on status information available through a health check endpoint implemented by the first microservice virtual machine.

15. A method of providing cloud-based identity and access management, comprising:
receiving a request for an identity management service;
authenticating the request;
forwarding the request to a first microservice configured to perform the identity management service, the first microservice being at least one of a plurality of microservices implemented by microservice virtual machines that are provisioned by a provisioning framework, wherein
the provisioning framework stores metadata information about the provisioned microservice virtual machines in a registry,
the forwarding is according to routing information configured based on metadata information stored in the registry and is performed in part by a routing tier that discovers routes to the provisioned microservice virtual machines; and

performing the identity management service by the microservice.

16. The method of claim 15 , wherein the metadata information identifies a first microservice virtual machine that implements the first microservice.

17. The method of claim 15 , wherein the metadata information comprises an internet protocol (IP) address of the first microservice virtual machine that implements the first microservice.

18. The method of claim 15 , wherein a service discovery agent (SDA) is implemented as a common code kernel on virtual machines provisioned by the provisioning framework to implement a service node, a cache node, or a routing node, wherein the provisioning framework stores respective metadata information in the registry for implemented virtual machines.

19. The method of claim 18 , wherein the metadata information stored in the registry for the microservice virtual machines is used by one or more SDAs on one or more routing nodes in the routing tier to determine the routing information for routing the request.

20. A system for providing cloud-based identity and access management, comprising:
a processor coupled to memory storing instructions, wherein, when executing the instructions, the processor is configured to:
receive a request for an identity management service;
authenticate the request;
forward the request to a first microservice configured to perform the identity management service, the first microservice being at least one of a plurality of microservices implemented by microservice virtual machines that are provisioned by a provisioning framework, wherein
the provisioning framework stores metadata information about the provisioned microservice virtual machines in a registry,
the forwarding is according to routing information configured based on metadata information stored in the registry and is performed in part by a routing tier that discovers routes to the provisioned microservice virtual machines; and

perform the identity management service by the microservice.

Assignees

• Oracle Int Corp

Inventors

• Gupta Lokesh
• Lander Vadim

Classifications

• G06F21/41

  where a single sign-on provides access to a plurality of computers · CPC title

• H04L63/0815

  providing single-sign-on or federations · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• H04L63/04

  for providing a confidential data exchange among entities communicating through data packet networks · CPC title