Zero down time upgrade for a multi-tenant identity and data security management cloud service

Patent metadata

Field	Value
Publication number	US-10579367-B2
Application number	US-201916254761-A
Country	US
Kind code	B2
Filing date	Jan 23, 2019
Priority date	Aug 5, 2016
Publication date	Mar 3, 2020
Grant date	Mar 3, 2020

Abstract

Embodiments implement data versioning in a cloud-based identity management system. Embodiments provide a first microservice for performing an identity management service and having a corresponding first version application programming interface (“API”) that identifies the first microservice. Embodiments provide a second microservice for performing the identity management service, the second microservice comprising a new version of the first microservice and having a corresponding second version API that identifies the second microservice. Embodiments receive a request for performing the identity management service from a client of the identity management system, the request including a uniform resource locator (“URL”), where the first version API or the second version API are identified in the URL. Embodiments then perform the identity management service using either the first microservice or the second microservice based on the request and using tenant data stored in a database.

First claim

What is claimed is:

1. A method of implementing data versioning in a cloud-based identity management system, the method comprising:
providing a first service for performing an identity management service and having a corresponding first version application programming interface (API) that identifies and is used to access the first service, the first service configured to work with a first version of a user resource type schema that defines a first number of attributes;
providing a second service for performing the identity management service, the second service comprising a new version of the first service and having a corresponding second version API that is different from the first version API and that identifies and is used to access the second service, the second service configured to work with a second version of the user resource type schema that defines a second number of attributes;
receiving a request for performing the identity management service from a client of the identity management system, the request comprises a uniform resource locator (URL), wherein the first version API or the second version API are identified in the URL; and
performing the identity management service using either the first service and the first version of the user resource type schema or the second service and the second version of the user resource type schema based on the request and using tenant data stored in a database.

2. The method of claim 1 , wherein the new version of the first service comprises data versioning of the database used for the identity management service comprising attributes that are added or deprecated from previous versions of a schema of the database.

3. The method of claim 1 , further comprising:
providing a resource manager as a common data access layer, the resource manager receiving the request from the client.

4. The method of claim 1 , further comprising:
determining an upgrade to be applied to the first service to implement the second service, wherein the first service is in a first stateless middle tier in a first topology that includes a first web tier configured to route the request;
deploying a second topology that implements the upgrade, wherein the second topology includes a second stateless middle tier including the second service, wherein the second topology further includes a second web tier configured to route requests in the second topology;
testing the second service in the second topology using test data stored in the database;
promoting the second topology; and
draining and shutting down the first topology.

5. The method of claim 1 , wherein a resource portion of the URL identifies the first version API or the second version API, and a host portion of the URL identifies a tenancy of a resource related to the request, and the first service and the second service comprise microservices.

6. The method of claim 1 , wherein the identity management service comprises one of a login service, a single sign on (SSO) service, a federation service, a token service, a directory service, a provisioning service, or a role-based access control (RBAC) service.

7. The method of claim 4 , wherein a public cloud load balancer routes the request to the first web tier in the first topology based on an indication of the API version in the request.

8. A cloud-based identity management system comprising:
a first service for performing an identity management service and having a corresponding first version application programming interface (API) that identifies and is used to access the first service, the first service configured to work with a first version of a user resource type schema that defines a first number of attributes;
a second service for performing the identity management service, the second service comprising a new version of the first service and having a corresponding second version API that is different from the first version API and that identifies and is used to access the second service, the second service configured to work with a second version of the user resource type schema that defines a second number of attributes;
a resource manager comprising a common data access layer, the resource manager receiving a request for performing the identity management service from a client of the identity management system, the request comprises a uniform resource locator (URL), wherein the first version API or the second version API are identified in the URL;
a database coupled to both the first service and the second service; and
either the first service using the first version of the user resource type schema or the second service using the second version of the user resource type schema configured to perform the identity management service based on the request and using tenant data stored in a database.

9. The system of claim 8 , wherein the new version of the first service comprises data versioning of the database used for the identity management service comprising attributes that are added or deprecated from previous versions of a schema of the database.

10. The system of claim 8 , further comprising one or more processors configured to:
determine an upgrade to be applied to the first service to implement the second service, wherein the first service is in a first stateless middle tier in a first topology that includes a first web tier configured to route the request;
deploy a second topology that implements the upgrade, wherein the second topology includes a second stateless middle tier including the second service, wherein the second topology further includes a second web tier configured to route requests in the second topology;
test the second service in the second topology using test data stored in the database;
promote the second topology; and
drain and shut down the first topology.

11. The system of claim 8 , wherein a resource portion of the URL identifies the first version API or the second version API, and a host portion of the URL identifies a tenancy of a resource related to the request, and the first service and the second service comprise microservices.

12. The system of claim 8 , wherein the identity management service comprises one of a login service, a single sign on (SSO) service, a federation service, a token service, a directory service, a provisioning service, or a role-based access control (RBAC) service.

13. The system of claim 10 , further comprising a public cloud load balancer configured to route the request to the first web tier in the first topology based on an indication of the API version in the request.

14. The system of claim 13 , wherein the public cloud load balancer is configured to provide a first virtual internet protocol (VIP) address pointing to origin servers of the first topology and a second VIP address pointing to origin servers of the second topology.

15. A non-transitory computer readable medium having instructions stored thereon that, when executed by a processor, cause the processor to provide versioning in a cloud-based identity management system, the versioning comprising:
providing a first service for performing an identity management service and having a corresponding first version application programming interface (API) that identifies and is used to access the first service, the first service configured to work with a first version of a user resource type schema that defines a first number of attributes;
providing a second service for performing the identity management service, the second service comprising a new version of the first service and having a corresponding second version API that is different from the first version

Assignees

• Oracle Int Corp

Inventors

• Lander Vadim
• Gupta Lokesh

Classifications

• G06F11/3688

  for test execution, e.g. scheduling of test suites · CPC title

• H04L47/125

  by balancing the load, e.g. traffic engineering · CPC title

• H04L45/02

  Topology update or discovery · CPC title

• H04L63/0815 Primary

  providing single-sign-on or federations · CPC title

• G06F8/656 Primary

  while running · CPC title