Microservices based multi-tenant identity and data security management cloud service

Patent metadata

Field	Value
Publication number	US-2017331812-A1
Application number	US-201715450512-A
Country	US
Kind code	A1
Filing date	Mar 6, 2017
Priority date	May 11, 2016
Publication date	Nov 16, 2017
Grant date	—

Abstract

A system provides cloud-based identity and access management. The system receives a request for performing an identity management service, where the request includes a call to an application programming interface (“API”) that identifies the identity management service and a microservice configured to perform the identity management service. The system authenticates the request, accesses the microservice, and performs the identity management service by the microservice.

First claim

1 . A non-transitory computer readable medium having instructions stored thereon that, when executed by a processor, cause the processor to provide cloud-based identity and access management in a system that supports a plurality of tenants, the providing comprising:
receiving a request for performing an identity management service, wherein the request comprises a call to an application programming interface (API) that identifies the identity management service and a microservice out of a plurality of microservices that is configured to perform the identity management service; authenticating the request, wherein the request comprises a uniform resource locator (URL), wherein the microservice is identified in a first portion of the URL, a second portion of the URL identifies the API, and a third portion of the URL identifies a tenant out of the plurality of tenants; accessing the identified microservice; and performing the identity management service by the microservice using resources that correspond to the identified tenant.

2 . The computer readable medium of claim 1 , wherein communicating with the microservice is configured through an unnamed universal port of the m icroservice.

3 . The computer readable medium of claim 1 , wherein the microservice provides one or more capabilities by exposing one or more APIs, wherein communication with the microservice is implemented only through the one or more APIs.

4 . (canceled)

5 . The computer readable medium of claim 1 , wherein the microservice is stateless, horizontally scalable, and independently deployable.

6 . The computer readable medium of claim 1 , wherein each physical implementation of the microservice is configured to securely support multiple tenants.

7 . The computer readable medium of claim 1 , wherein the identity management service comprises a login service, a single sign on (SSO) service, a federation service, a token service, a directory service, a provisioning service, or a role-based access control (RBAC) service.

8 . The computer readable medium of claim 1 , wherein communication with the microservice is configured according to a lightweight protocol.

9 . The computer readable medium of claim 8 , wherein the lightweight protocol comprises a Hypertext Transfer Protocol (HTTP) and a Representational State Transfer (REST) protocol, wherein the request comprises a call to a RESTful HTTP API.

10 . The computer readable medium of claim 1 , wherein the microservice performs the identity management service based on tenant data stored in a database, wherein the database and the microservice are configured to scale independently of one another.

11 . The computer readable medium of claim 10 , wherein the database comprises a distributed data grid.

12 . A method of providing cloud-based identity and access management in a system that supports a plurality of tenants, the method comprising:
receiving a request for performing an identity management service, wherein the request comprises a call to an application programming interface (API) that identifies the identity management service and a microservice out of a plurality of microservices that is configured to perform the identity management service; authenticating the request, wherein the request comprises a uniform resource locator (URL), wherein the microservice is identified in a first portion of the URL, a second portion of the URL identifies the API, and a third portion of the URL identifies a tenant out of the plurality of tenants; accessing the identified microservice; and performing the identity management service by the microservice using resources that correspond to the identified tenant.

13 . The method of claim 12 , wherein communicating with the microservice is configured through an unnamed universal port of the microservice.

14 . The method of claim 12 , wherein the microservice provides one or more capabilities by exposing one or more APIs, wherein communication with the microservice is implemented only through the one or more APIs.

15 . (canceled)

16 . The method of claim 12 , wherein the microservice is stateless, horizontally scalable, and independently deployable.

17 . The method of claim 12 , wherein each physical implementation of the microservice is configured to securely support multiple tenants.

18 . The method of claim 12 , wherein the identity management service comprises a login service, a single sign on (SSO) service, a federation service, a token service, a directory service, a provisioning service, or a role-based access control (RBAC) service.

19 . The method of claim 12 , wherein communication with the microservice is configured according to a lightweight protocol.

20 . A system for providing cloud-based identity and access management, comprising:
a plurality of tenants; a plurality of microservices; a receiving module that receives a request for performing an identity management service, wherein the request comprises a call to an application programming interface (API) that identifies the identity management service and a microservice out of the plurality of microservices that is configured to perform the identity management service; an authenticating module that authenticates the request, wherein the request comprises a uniform resource locator (URL), wherein the microservice is identified in a first portion of the URL, a second portion of the URL identifies the API, and a third portion of the URL identifies a tenant out of the plurality of tenants; an accessing module that accesses the identified microservice; and a performing module that performs the identity management service by the microservice using resources that correspond to the identified tenant.

21 . The method of claim 12 , wherein the microservice performs the identity management service based on tenant data stored in a database, wherein the database and the microservice are configured to scale independently of one another and the database comprises a distributed data grid.

22 . The system of claim 20 , wherein the microservice performs the identity management service based on tenant data stored in a database, wherein the database and the microservice are configured to scale independently of one another and the database comprises a distributed data grid.

Assignees

• Oracle Int Corp

Inventors

• Lander Vadim
• Carru Damien
• Cole Gary P
• Sondhi Ajay
• Wilson Gregg

Classifications

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title

• H04L63/0815 Primary

  providing single-sign-on or federations · CPC title

• H04L63/0861

  using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231) · CPC title

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title