User authorization and authentication accessing microservices across spaces

Patent metadata

Field	Value
Publication number	US-2021218743-A1
Application number	US-202016741981-A
Country	US
Kind code	A1
Filing date	Jan 14, 2020
Priority date	Jan 14, 2020
Publication date	Jul 15, 2021
Grant date	—

Abstract

A cloud computing environment may have a landscape space for singleton applications including a SAAS UAA component to receive a subscription request associated with a user and a platform SAAS application. A user system registry may indicate spaces in which the user is registered, a route proxy agent may route communications via a first secure communication channel in accordance with information in the user system registry, and a route service broker may handle binding requests. The environment may also include a first system space for first system microservices with a first system onboarding application that receives provisioning application information via the route proxy agent and the secure communication channel. First backend microservices may similarly receive application router information, and a first route service shared instance clone may provide binding requests to the route service broker. A second system space for second system microservices may similarly be provided.

First claim

1 . A computing environment associated with cloud computing, comprising:
a landscape space for singleton applications, including:
a Software As a Service (“SAAS”) User Authorization and Authentication (“UAA”) component to receive a subscription request associated with a user and a platform SAAS application,
a user system registry indicating spaces in which the user is registered,
a route proxy agent to route communications via a first secure communication channel in accordance with information in the user system registry, and
a route service broker to handle binding requests; and
a first system space for first system microservices, including:
a first system onboarding application to receive provisioning application information from the user via the route proxy agent and the first secure communication channel,
first backend microservices to receive application router information from the user via the route proxy agent and the first secure communication channel, and
a first route service shared instance clone to provide binding requests of the first system onboarding application and the first backend microservices to the route service broker.

2 . The computing environment of claim 1 , wherein the user is associated with a tenant of a multi-tenant cloud computing environment.

3 . The computing environment of claim 2 , wherein the user transmits a subscribe application request to the platform SAAS application and the platform SAAS application transmits a subscribe tenant request to the SAAS UAA component.

4 . The computing environment of claim 1 , wherein a route binding is sent from the first backend microservices to the first route service shared instance clone via a first end User Interface (“UI”) application in the first system space for first system microservices.

5 . The computing environment of claim 1 , wherein the route proxy agent validates JavaScript Object Notation (“JSON”) Web Token (“JWT”) information associated with a request received from the user.

6 . The computing environment of claim 5 , wherein the route proxy agent compares a user identifier of the JWT information and a system identifier from a requested route with information in the user system registry.

7 . The computing environment of claim 6 , wherein the system identifier is based on at least one of the following in the requested route: (i) a host, (ii) a path, (iii) a header, and (iv) a message body.

8 . The computing environment of claim 1 , further comprising:
a second system space for second system microservices, including:
a second system onboarding application to receive provisioning application information from the user via the route proxy agent and the second secure communication channel,
second backend microservices to receive application router information from the user via the route proxy agent and the second secure communication channel, and
a second route service shared instance clone to provide binding requests of the second system onboarding application and the second backend microservices to the route service broker.

9 . The computing environment of claim 1 , wherein the binding request is provided via a route service shared instance clone in the first system space and a route service shared instance in the landscape space for singleton applications.

10 . The computing environment of claim 1 , wherein the cloud computing environment is a Cloud Foundry (“CF”) computing environment.

11 . The computing environment of claim 10 , wherein the route service broker utilizes CF route services and open service broker Application Programming Interface (“API”) specifications.

12 . A computer-implemented method associated with a cloud computing environment, comprising:
receiving, at a Software As a Service (“SAAS”) User Authorization and Authentication (“UAA”) component of a landscape space for singleton applications, a subscription request associated with a user and a platform SAAS application; routing, by a route proxy agent of the landscape space for singleton applications, communications via a first secure communication channel in accordance with information in a user system registry, wherein the user system registry indicates spaces in which the user is registered; handling, by a route service broker of the landscape space for singleton applications, binding requests; receiving, at a first system onboarding application of a first system space for first system microservices, provisioning application information from the user via the route proxy agent and the first secure communication channel; receiving, at first backend microservices of the first system space for first system microservices, application router information from the user via the route proxy agent and the first secure communication channel; and providing, from a first route service shared instance clone of the first system space for first system microservices, binding requests of the first system onboarding application and the first backend microservices to the route service broker.

13 . The method of claim 12 , wherein the user is associated with a tenant of a multi-tenant cloud computing environment.

14 . The method of claim 13 , wherein the user transmits a subscribe application request to the platform SAAS application and the platform SAAS application transmits a subscribe tenant request to the SAAS UAA component.

15 . The method of claim 12 , wherein a route binding is sent from the first backend microservices to the first route service shared instance clone via a first end User Interface (“UP”) application in the first system space for first system microservices.

16 . The method of claim 12 , wherein the route proxy agent validates JavaScript Object Notation (“JSON”) Web Token (“JWT”) information associated with a request received from the user.

17 . The method of claim 16 , wherein the route proxy agent compares a user identifier of the JWT information and a system identifier from a requested route with information in the user system registry.

18 . The method of claim 17 , wherein the system identifier is based on at least one of the following in the requested route: (i) a host, (ii) a path, (iii) a header, and (iv) a message body.

19 . A non-transitory, computer readable medium having executable instructions stored therein, the medium comprising:
instruction to receive, at a Software As a Service (“SAAS”) User Authorization and Authentication (“UAA”) component of a landscape space for singleton applications, a subscription request associated with a user and a platform SAAS application; instruction to route, by a route proxy agent of the landscape space for singleton applications, communications via a first secure communication channel in accordance with information in a user system registry, wherein the user system registry indicates spaces in which the user is registered; instruction to handle, by a route service broker of the landscape space for singleton applications, binding requests; instruction to receive, at a first system onboarding application of a first system space for first system microservices, provisioning application information from the user via the route proxy agent and the first secure communication channel; instruction to receive, at first backend microservices of the first system space for first system microservices, application router information from the user via the route proxy agent and the first secure communication channel; and instruction to provide, from a first route service shared instance clone of the first sy

Assignees

• Sap Se

Inventors

• Ahuja Sapreen

Classifications

• H04L67/567

  Integrating service provisioning from a plurality of service providers · CPC title

• H04L67/133

  Protocols for remote procedure calls [RPC] · CPC title

• H04L67/563

  Data redirection of data network streams · CPC title

• G06F21/604

  Tools and structures for managing or administering access control systems · CPC title

• H04L63/0892 Primary

  by using authentication-authorization-accounting [AAA] servers or protocols · CPC title