Zero down time upgrade for a multi-tenant identity and data security management cloud service

• US 10,255,061 B2
• Filed: 07/27/2017
• Issued: 04/09/2019
• Est. Priority Date: 08/05/2016
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Lander, Vadim, Gupta, Lokesh
• Primary Examiner(s): Zhen, Wei Y
• Assistant Examiner(s): Wu, Junchun
• Application Number:
  US15/661,024
• Publication Number:
  US 20180039494A1
• Time in Patent Office: 621 Days
• Field of Search: 717172
• CPC Class Codes: G06F 11/3664 Environments for testing or debugging software
• CPC Class Codes: G06F 11/3688 for test execution, e.g. scheduling of test suites
• CPC Class Codes: G06F 8/656 while running
• CPC Class Codes: H04L 45/02 Topology update or discovery
• CPC Class Codes: H04L 47/125 by balancing the load, e.g. traffic engineering
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations

Abstract

A system provides cloud-based identity and access management. The system receives a request for performing an identity management service. The request identifies the service and a current version of a microservice. The current version of the microservice is in a first stateless middle tier in a first topology that includes a first web tier. The system performs the identity management service by the current version of the microservice using tenant data stored in a database. The system then determines an upgrade to be applied to the microservice, and deploys a second topology that implements the upgrade. The second topology includes a second web tier and a second stateless middle tier including a new version of the microservice. The system tests the new version of the microservice in the second topology using test data stored in the database, promotes the second topology, and drains and shuts down the first topology.

Claims

1. A non-transitory computer readable medium having instructions stored thereon that, when executed by a processor, cause the processor to provide cloud-based identity and access management, the providing comprising:

receiving a request for performing an identity management service, wherein the request identifies the identity management service and a current version of a microservice configured to perform the identity management service, wherein the current version of the microservice is in a first stateless middle tier in a first topology that includes a first web tier configured to route the request;

performing the identity management service by the current version of the microservice using tenant data stored in a database;

determining an upgrade to be applied to the microservice;

deploying a second topology that implements the upgrade, wherein the second topology includes a second stateless middle tier including a new version of the microservice, wherein the second topology further includes a second web tier configured to route requests in the second topology;

testing the new version of the microservice in the second topology using test data stored in the database;

promoting the second topology; and

draining and shutting down the first topology.

2. The computer readable medium of claim 1, wherein the testing of the new version of the microservice is performed concurrently with the performing of the identity management service by the current version of the microservice, wherein the testing and the performing do not affect each other.

3. The computer readable medium of claim 1, wherein the tenant data used by the first topology and the test data used by the second topology are isolated from each other in the database.

4. The computer readable medium of claim 1, wherein the request comprises a call to an application programming interface (API) that identifies the identity management service and the current version of the microservice.

5. The computer readable medium of claim 1, wherein the microservice provides one or more capabilities by exposing one or more APIs, wherein communication with the microservice is implemented only through the one or more APIs.

6. The computer readable medium of claim 1, wherein the request comprises a uniform resource locator (URL), wherein the microservice and the current version of the microservice are identified in a prefix of the URL, wherein a resource portion of the URL identifies the API, wherein a host portion of the URL identifies a tenancy of a resource related to the request.

7. The computer readable medium of claim 6, wherein a public cloud load balancer routes the request to the first web tier in the first topology based on an indication of the current version in the request.

8. The computer readable medium of claim 1, wherein the microservice is horizontally scalable and independently deployable.

9. The computer readable medium of claim 1, wherein each physical implementation of the microservice is configured to securely support multiple tenants.

10. The computer readable medium of claim 1, wherein the identity management service comprises a login service, a single sign on (SSO) service, a federation service, a token service, a directory service, a provisioning service, or a role-based access control (RBAC) service.

11. The computer readable medium of claim 1, wherein communication with the microservice is configured according to a lightweight protocol.

12. The computer readable medium of claim 11, wherein the lightweight protocol comprises a Hypertext Transfer Protocol (HTTP) and a Representational State Transfer (REST) protocol, wherein the request comprises a call to a RESTful HTTP API.

13. The computer readable medium of claim 1, wherein the database and the microservice are configured to scale independently of one another.

14. The computer readable medium of claim 13, wherein the database comprises a distributed data grid.

15. The computer readable medium of claim 1, wherein a public cloud load balancer in a public cloud routing tier load balances requests across traffic directors in the first web tier and the second web tier.

16. The computer readable medium of claim 15, wherein the public cloud load balancer provides a first virtual internet protocol (VIP) address pointing to origin servers of the first topology and a second VIP address pointing to origin servers of the second topology.

17. The computer readable medium of claim 16, wherein the second topology is promoted and made current by pointing the first VIP to the origin servers of the second topology and disabling the second VIP.

18. A method of providing cloud-based identity and access management, comprising:

receiving a request for performing an identity management service, wherein the request identifies the identity management service and a current version of a microservice configured to perform the identity management service, wherein the current version of the microservice is in a first stateless middle tier in a first topology that includes a first web tier configured to route the request;

performing the identity management service by the current version of the microservice using tenant data stored in a database;

determining an upgrade to be applied to the microservice;

deploying a second topology that implements the upgrade, wherein the second topology includes a second stateless middle tier including a new version of the microservice, wherein the second topology further includes a second web tier configured to route requests in the second topology;

testing the new version of the microservice in the second topology using test data stored in the database;

promoting the second topology; and

draining and shutting down the first topology.

19. The method of claim 18, wherein the testing of the new version of the microservice is performed concurrently with the performing of the identity management service by the current version of the microservice, wherein the testing and the performing do not affect each other.

20. A system comprising:

a processor; and

a non-transitory computer readable medium having instructions stored thereon that, when executed by the processor, cause the processor to provide cloud-based identity and access management, the providing comprising;

receiving a request for performing an identity management service, wherein the request identifies the identity management service and a current version of a microservice configured to perform the identity management service, wherein the current version of the microservice is in a first stateless middle tier in a first topology that includes a first web tier configured to route the request;

performing the identity management service by the current version of the microservice using tenant data stored in a database;

determining an upgrade to be applied to the microservice;

deploying a second topology that implements the upgrade, wherein the second topology includes a second stateless middle tier including a new version of the microservice, wherein the second topology further includes a second web tier configured to route requests in the second topology;

testing the new version of the microservice in the second topology using test data stored in the database;

promoting the second topology; and

draining and shutting down the first topology.