Multi-tenant identity and data security management cloud service

Patent metadata

Field	Value
Publication number	US-9781122-B1
Application number	US-201715485532-A
Country	US
Kind code	B1
Filing date	Apr 12, 2017
Priority date	May 11, 2016
Publication date	Oct 3, 2017
Grant date	Oct 3, 2017

Abstract

A system provides cloud-based identity and access management. The system receives a request from a client for an identity management service, authenticates the request, and accesses a microservice based on the request. The system determines, based on the request, a tenancy of the client, a tenancy of a user, and a tenancy of a resource. The system retrieves data from the determined tenancies as required to process the request, where the data is retrieved by the microservice using a connection pool that provides connections to the database. The system then performs the identity management service by the appropriate microservice responsible for processing the received request.

First claim

What is claimed is:

1. A non-transitory computer readable medium having instructions stored thereon that, when executed by a processor, cause the processor to provide cloud-based identity and access management, the providing comprising:
receiving a request from a client for an identity management service;
authenticating the request;
accessing a microservice based on the request;
determining, based on the request, a tenancy of the client, a tenancy of a user related to the request, and a tenancy of a resource related to the request;
retrieving data from at least one of the tenancy of the client, the tenancy of the user, or the tenancy of the resource in a database, wherein the data is retrieved by the microservice using a connection pool that provides connections to the database; and
performing the identity management service by the microservice using the data;
wherein the microservice uses a proxy user to connect to a respective connection in the connection pool and the proxy user represents a tenant in the database.

2. The computer readable medium of claim 1 , wherein the identity management service includes obtaining an access token for the user to access the resource, wherein the token identifies the tenancy of the resource and the tenancy of the user.

3. The computer readable medium of claim 1 , wherein the microservice is stateless.

4. The computer readable medium of claim 1 , wherein the microservice comprises a OAuth microservice.

5. The computer readable medium of claim 1 , wherein Uniform Resource Locator (URL) token identifies the tenancy of the client, the tenancy of a user related to the request, and the tenancy of the resource.

6. The computer readable medium of claim 1 , wherein the database and the microservice are configured to scale independently of one another.

7. The computer readable medium of claim 1 , wherein the database comprises a distributed data grid.

8. The computer readable medium of claim 1 , wherein at least two of the tenancy of the client, the tenancy of the user, and the tenancy of the resource are the same tenancy.

9. A method of providing cloud-based identity and access management, comprising:
receiving a request from a client for an identity management service;
authenticating the request;
accessing a microservice based on the request;
determining, based on the request, a tenancy of the client, a tenancy of a user related to the request, and a tenancy of a resource related to the request;
retrieving data from at least one of the tenancy of the client, the tenancy of the user, or the tenancy of the resource in a database, wherein the data is retrieved by the microservice using a connection pool that provides connections to the database; and
performing the identity management service by the microservice using the data;
wherein the microservice uses a proxy user to connect to a respective connection in the connection pool and the proxy user represents a tenant in the database.

10. The method of claim 9 , wherein the identity management service includes obtaining an access token for the user to access the resource, wherein the token identifies the tenancy of the resource and the tenancy of the user.

11. The method of claim 9 , wherein the microservice is stateless.

12. The method of claim 9 , wherein the microservice comprises a OAuth microservice.

13. The method of claim 9 , wherein a Uniform Resource Locator (URL) token identifies the tenancy of the client, the tenancy of a user related to the request, and the tenancy of the resource.

14. The method of claim 9 , wherein the database and the microservice are configured to scale independently of one another.

15. The method of claim 9 , wherein the database comprises a distributed data grid.

16. The method of claim 9 , wherein at least two of the tenancy of the client, the tenancy of the user, and the tenancy of the resource are the same tenancy.

17. A system for providing cloud-based identity and access management, comprising:
one or more processors coupled to a storage device comprising instructions that when executed by the one or more processors implement a security gate and a microservice;
the security gate that receives a request from a client for an identity management service;
the security gate authenticating the request;
the security gate accessing the microservice based on the request;
the microservice determining, based on the request, a tenancy of the client, a tenancy of a user related to the request, and a tenancy of a resource related to the request;
the microservice retrieving data from at least one of the tenancy of the client, the tenancy of the user, or the tenancy of the resource in a database, wherein the microservice retrieves the data using a connection pool that provides connections to the database; and
the microservice performing the identity management service using the data;
wherein the microservice uses a proxy user to connect to a respective connection in the connection pool and the proxy user represents a tenant in the database.

18. The system of claim 17 , wherein the identity management service includes obtaining an access token for the user to access the resource, wherein the token identifies the tenancy of the resource and the tenancy of the user.

19. The system of claim 17 , wherein the microservice is stateless.

20. The system of claim 17 , wherein the microservice comprises a OAuth microservice.

Assignees

• Oracle Int Corp

Inventors

• Wilson Gregg
• Knappek Tomas

Classifications

• H04L63/0281

  Proxies · CPC title

• H04W12/06

  Authentication · CPC title

• H04W12/08

  Access security · CPC title

• H04L63/0815

  providing single-sign-on or federations · CPC title

• H04L63/0807

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title