Policy enforcement point for a multi-tenant identity and data security management cloud service

Patent metadata

Field	Value
Publication number	US-11088993-B2
Application number	US-201916537722-A
Country	US
Kind code	B2
Filing date	Aug 12, 2019
Priority date	May 11, 2016
Publication date	Aug 10, 2021
Grant date	Aug 10, 2021

Abstract

An embodiment controls access to a resource, the access controlled by a multi-tenant system. Embodiments receive, at a web server, a request for the resource from a user via a web browser, the request including a Uniform Resource Locator (“URL”) associated with the resource and an identity of a tenant corresponding to the user. Embodiments determine an access policy for authenticating the user that is associated with the resource, the access policy based in part on the identity of the tenant. Embodiments then authenticate the user based on the determined access policy.

First claim

What is claimed is:

1. A method of controlling access to a resource, the access controlled by a multi-tenant system, the method comprising:
receiving at a web server a request for the resource from a user via a web browser, the request comprising a Uniform Resource Locator (URL) associated with the resource and an identity of a tenant corresponding to the user, the request comprising a call to an application programming interface (API) corresponding to the web server and the identity of the tenant is included in the URL;
determining an access policy for authenticating the user that is associated with the resource, the access policy based in part on the identity of the tenant, the determining the access policy determining whether access to the resource by the user is allowed and a method of access that is used to gain access to the resource; and
authenticating the user based on the determined access policy.

2. The method of claim 1 , wherein the determining the access policy comprises determining if the resource is protected, wherein the method of access comprise one of: requiring a username and password to access the resource, and token based authentication.

3. The method of claim 1 , the authenticating comprising requesting and receiving credentials from the user.

4. The method of claim 3 , wherein the credentials comprise a username and password.

5. The method of claim 3 , further comprising validating the credentials by sending the credentials to an OAuth based server.

6. The method of claim 5 , the sending comprising returning an Hypertext Transfer Protocol (HTTP) redirect status code that directs the web browser to the OAuth based server.

7. The method of claim 6 , further comprising obtaining an access token, validating the access token and issuing a local session cookie to the web browser.

8. The method of claim 5 , wherein the OAuth based server redirects the web browser to a single sign-on (SSO) server.

9. The method of claim 5 , wherein the OAuth based server comprises a microservice.

10. The method of claim 1 , the access policy comprising one of basic authentication or token based authentication.

11. A non-transitory computer readable medium having instructions stored thereon that, when executed by a processor, cause the processor to controlling access to a resource, the access controlled by a multi-tenant system, the access control comprising:
receiving at a web server a request for the resource from a user via a web browser, the request comprising a Uniform Resource Locator (URL) associated with the resource and an identity of a tenant corresponding to the user, the request comprising a call to an application programming interface (API) corresponding to the web server and the identity of the tenant is included in the URL;
determining an access policy for authenticating the user that is associated with the resource, the access policy based in part on the identity of the tenant, the determining the access policy determining whether access to the resource by the user is allowed and a method of access that is used to gain access to the resource; and
authenticating the user based on the determined access policy.

12. The computer readable medium of claim 11 , wherein the determining the access policy comprises determining if the resource is protected, wherein the method of access comprise one of: requiring a username and password to access the resource, and token based authentication.

13. The computer readable medium of claim 11 , the authenticating comprising requesting and receiving credentials from the user.

14. The computer readable medium of claim 13 , wherein the credentials comprise a username and password.

15. The computer readable medium of claim 13 , further comprising validating the credentials by sending the credentials to an OAuth based server.

16. The computer readable medium of claim 15 , the sending comprising returning an Hypertext Transfer Protocol (HTTP) redirect status code that directs the web browser to the OAuth based server.

17. The computer readable medium of claim 11 , the access policy comprising one of basic authentication or token based authentication.

18. A multi-tenant system that controls access to a resource, the system comprising:
one or more hardware processors adapted to execute software instructions;
a policy enforcement point (PEP), implemented by at least one of the processors when executing the instructions, that receives a request for the resource from a user via a web browser, the request comprising a Uniform Resource Locator (URL) associated with the resource and an identity of a tenant corresponding to the user, the request comprising a call to an application programming interface (API) corresponding to the PEP and the identity of the tenant is included in the URL and that determines an access policy for authenticating the user that is associated with the resource, the access policy based in part on the identity of the tenant, the determining the access policy determining whether access to the resource by the user is allowed and a method of access that is used to gain access to the resource; and
a policy decision point (PDP), implemented by at least one of the processors when executing the instructions, that authenticates the user based on the determined access policy.

19. The system of claim 18 , wherein the PDP comprises an OAuth based server.

20. The system of claim 18 , wherein the PEP and the PDP are implemented by a web server.

Assignees

• Oracle Int Corp

Inventors

• WARDELL Stephan
• Folkins Andrew B
• Lander Vadim
• Mishra Prateek
• Levinson Rich
• Womacks Cory
• Cuthbert Dino E

Classifications

• H04L67/568

  Storing data temporarily at an intermediate stage, e.g. caching · CPC title

• H04L67/563

  Data redirection of data network streams · CPC title

• H04L63/205

  involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24) · CPC title

• H04L67/146

  Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding · CPC title

• H04L63/0281 Primary

  Proxies · CPC title