Microservices based multi-tenant identity and data security management cloud service

Patent metadata

Field	Value
Publication number	US-9838376-B1
Application number	US-201715450512-A
Country	US
Kind code	B1
Filing date	Mar 6, 2017
Priority date	May 11, 2016
Publication date	Dec 5, 2017
Grant date	Dec 5, 2017

Abstract

A system provides cloud-based identity and access management. The system receives a request for performing an identity management service, where the request includes a call to an application programming interface (“API”) that identifies the identity management service and a microservice configured to perform the identity management service. The system authenticates the request, accesses the microservice, and performs the identity management service by the microservice.

First claim

What is claimed is:

1. A non-transitory computer readable medium having instructions stored thereon that, when executed by a processor, cause the processor to provide cloud-based identity and access management in a system that supports a plurality of tenants, the providing comprising:
receiving a request for performing an identity management service, wherein the request comprises a call to an application programming interface (API) that identifies the identity management service and a microservice out of a plurality of microservices that is configured to perform the identity management service;
authenticating the request, wherein the request comprises a uniform resource locator (URL), wherein the microservice is identified in a first portion of the URL, a second portion of the URL identifies the API, and a third portion of the URL identifies a tenant out of the plurality of tenants;
accessing the identified microservice; and
performing the identity management service by the microservice using resources that correspond to the identified tenant.

2. The computer readable medium of claim 1 , wherein communicating with the microservice is configured through an unnamed universal port of the microservice.

3. The computer readable medium of claim 1 , wherein the microservice provides one or more capabilities by exposing one or more APIs, wherein communication with the microservice is implemented only through the one or more APIs.

4. The computer readable medium of claim 1 , wherein the microservice is stateless, horizontally scalable, and independently deployable.

5. The computer readable medium of claim 1 , wherein each physical implementation of the microservice is configured to securely support multiple tenants.

6. The computer readable medium of claim 1 , wherein the identity management service comprises a login service, a single sign on (SSO) service, a federation service, a token service, a directory service, a provisioning service, or a role-based access control (RBAC) service.

7. The computer readable medium of claim 1 , wherein communication with the microservice is configured according to a lightweight protocol.

8. The computer readable medium of claim 7 , wherein the lightweight protocol comprises a Hypertext Transfer Protocol (HTTP) and a Representational State Transfer (REST) protocol, wherein the request comprises a call to a RESTful HTTP API.

9. The computer readable medium of claim 1 , wherein the microservice performs the identity management service based on tenant data stored in a database, wherein the database and the microservice are configured to scale independently of one another.

10. The computer readable medium of claim 9 , wherein the database comprises a distributed data grid.

11. A method of providing cloud-based identity and access management in a system that supports a plurality of tenants, the method comprising:
receiving a request for performing an identity management service, wherein the request comprises a call to an application programming interface (API) that identifies the identity management service and a microservice out of a plurality of microservices that is configured to perform the identity management service;
authenticating the request, wherein the request comprises a uniform resource locator (URL), wherein the microservice is identified in a first portion of the URL, a second portion of the URL identifies the API, and a third portion of the URL identifies a tenant out of the plurality of tenants;
accessing the identified microservice; and
performing the identity management service by the microservice using resources that correspond to the identified tenant.

12. The method of claim 11 , wherein communicating with the microservice is configured through an unnamed universal port of the microservice.

13. The method of claim 11 , wherein the microservice provides one or more capabilities by exposing one or more APIs, wherein communication with the microservice is implemented only through the one or more APIs.

14. The method of claim 11 , wherein the microservice is stateless, horizontally scalable, and independently deployable.

15. The method of claim 11 , wherein each physical implementation of the microservice is configured to securely support multiple tenants.

16. The method of claim 11 , wherein the identity management service comprises a login service, a single sign on (SSO) service, a federation service, a token service, a directory service, a provisioning service, or a role-based access control (RBAC) service.

17. The method of claim 11 , wherein communication with the microservice is configured according to a lightweight protocol.

18. The method of claim 11 , wherein the microservice performs the identity management service based on tenant data stored in a database, wherein the database and the microservice are configured to scale independently of one another and the database comprises a distributed data grid.

19. A system for providing cloud-based identity and access management, comprising:
a plurality of tenants;
a plurality of microservices;
a receiving module that receives a request for performing an identity management service, wherein the request comprises a call to an application programming interface (API) that identifies the identity management service and a microservice out of the plurality of microservices that is configured to perform the identity management service;
an authenticating module that authenticates the request, wherein the request comprises a uniform resource locator (URL), wherein the microservice is identified in a first portion of the URL, a second portion of the URL identifies the API, and a third portion of the URL identifies a tenant out of the plurality of tenants;
an accessing module that accesses the identified microservice; and
a performing module that performs the identity management service by the microservice using resources that correspond to the identified tenant.

20. The system of claim 19 , wherein the microservice performs the identity management service based on tenant data stored in a database, wherein the database and the microservice are configured to scale independently of one another and the database comprises a distributed data grid.

Assignees

• Oracle Int Corp

Inventors

• Lander Vadim
• Carru Damien
• Cole Gary P
• Sondhi Ajay
• Wilson Gregg

Classifications

• H04L63/104

  Grouping of entities · CPC title

• H04L63/0815 Primary

  providing single-sign-on or federations · CPC title

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title