External platform extensions in a multi-tenant environment

Patent metadata

Field	Value
Publication number	US-9825964-B2
Application number	US-201615347640-A
Country	US
Kind code	B2
Filing date	Nov 9, 2016
Priority date	Jul 25, 2013
Publication date	Nov 21, 2017
Grant date	Nov 21, 2017

Abstract

Enforcing access control to individual extensions of services in a multi-tenant cloud environment by initializing objects for the extension based on public and private configuration files with service access rules that are merged is described. This allows third party vendors to specify payment rules for their own extensions while securely keeping the core extension configuration files. Tenants of the multi-tenant cloud environment can pick and choose which services to purchase, and the cloud environment automates the process of accessing the service using the third-party developer's tenant access list rules.

First claim

What is claimed is:

1. A method comprising:
determining, by a computer system providing a cloud environment, a first configuration file compatible with a file schema, wherein one or more features of one or more services in the cloud environment are configurable for multi-tenant access;
receiving a delta file created based on a modification to the first configuration file, wherein the delta file includes one or more configurations for one or more class definitions of a feature of a service in the cloud environment, wherein the delta file includes an access rule to control multi-tenant access for the feature of the service, and wherein the delta file is compatible with the file schema;
creating, by the computer system, a second configuration file for the feature of the service, the second configuration file being executable and including the access rule, wherein the second configuration file is created based on merging the delta file with the first configuration file;
initiating the computer system to restart, wherein restarting the computer system causes the computer system to read the second configuration file;
instantiating, by the computer system, one or more objects for the feature of the service based on the second configuration file that is read based on restarting the computer system; and
determining access to the feature of the service for a user requesting access to the feature, wherein the access to the feature of the service for the user is determined using the access rule in the second configuration file used to instantiate the one or more objects.

2. The method of claim 1 , further comprising:
configuring, by the computing system, the feature of the service based on the one or more objects instantiated for the feature of the service.

3. The method of claim 1 , further comprising:
denying the access to the feature of the service based on determining that the access to the feature of the service is not permitted according to the access rule; and
granting the access to the feature of the service based on determining that the access to the feature of the service is permitted according to the access rule.

4. The method of claim 1 , further comprising:
managing a counter for access to the feature of the service based on determining the access to the feature of the service.

5. The method of claim 1 , wherein the one or more objects for the feature of the service are instantiated based on the second configuration file such that multiple tenants in the cloud environment have access to the feature of the service.

6. The method of claim 1 , further comprising:
delivering, by the computer system, a copy of the first configuration file to the user.

7. The method of claim 6 , wherein the user is a third-party developer, wherein the delta file is received in an archive file, wherein the modification is by the user, and wherein the modification to the first configuration file is based on the user editing the copy of the first configuration file.

8. The method of claim 1 , wherein the file schema defines an element, a child element, and an attribute.

9. The method of claim 1 , wherein the access rule is a tenant access list rule.

10. The method of claim 1 , wherein the access rule indicates access by a plurality of tenants to a plurality of services.

11. The method of claim 10 , wherein a tenant of the plurality of tenants is charged for each of the plurality of services permitted to be accessed based on the access rule.

12. The method of claim 1 , wherein the access rule indicates access by one or more tenants of the cloud environment to the one or more features of the one or more services.

13. The method of claim 1 , wherein the second configuration file includes executable code, and wherein the second configuration file is compatible with the file schema.

14. The method of claim 1 , wherein the user is one of a plurality of tenants.

15. The method of claim 1 , further comprising:
detecting an error reading a configuration from the second configuration file; and
upon detecting the error, preventing the configuration from being read from the second configuration file;
wherein the one or more objects for the feature of the service are instantiated without using the configuration that is prevented from being read from the second configuration file.

16. A system comprising:
one or more processors; and
a memory accessible to the one or more processors, the memory storing one or more instructions that, upon execution by the one or more processors, causes the one or more processors to:
determine, by a computer system providing a cloud environment, a first configuration file compatible with a file schema, wherein one or more features of one or more services in the cloud environment are configurable for multi-tenant access;
receive a delta file created based on a modification to the first configuration file, wherein the delta file includes one or more configurations for one or more class definitions of a feature of a service in the cloud environment, wherein the delta file includes an access rule to control multi-tenant access for the feature of the service, and wherein the delta file is compatible with the file schema;
create, by the computer system, a second configuration file for the feature of the service, the second configuration file being executable and including the access rule, wherein the second configuration file is created based on merging the delta file with the first configuration file;
initiate the computer system to restart, wherein restarting the computer system causes the computer system to read the second configuration file;
instantiate, by the computer system, one or more objects for the feature of the service based on the second configuration file that is read based on restarting the computer system; and
determine access to the feature of the service for a user requesting access to the feature, wherein the access to the feature of the service for the user is determined using the access rule in the second configuration file used to instantiate the one or more objects.

17. The system of claim 16 , wherein the one or more instructions, which upon execution by the one or more processors, further causes the one or more processors to:
configure the feature of the service based on the one or more objects instantiated for the feature of the service;
deny the access to the feature of the service based on determining that the access to the feature of the service is not permitted according to the access rule; and
grant the access to the feature of the service based on determining that the access to the feature of the service is permitted according to the access rule.

18. A non-transitory computer-readable medium storing one or more instructions for causing one or more computers to perform operations comprising:
determining, by a computer providing a cloud environment, a first configuration file compatible with a file schema, wherein one or more features of one or more services in the cloud environment are configurable for multi-tenant access;
receiving a delta file created based on a modification to the first configuration file, wherein the delta file includes one or more configurations for one or more class definitions of a feature of a service in the cloud environment, wherein the delta file includes an access rule to control multi-tenant access for the feature of the service, and wherein the delta file is compatible with the file schema;
creating, by the computer, a second configuration file for the feature of the service,

Assignees

• Oracle Int Corp

Inventors

• Mellor David R
• Jones Andrew H
• Lattimer Charles

Classifications

• G06F17/30923

  Physics · mapped topic

• G06F9/44505

  Configuring for program initiating, e.g. using registry, configuration files · CPC title

• G06F17/30073

  Physics · mapped topic

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• H04L67/1002

  Electricity · mapped topic