Zero down time upgrade for a multi-tenant identity and data security management cloud service

• US 10,579,367 B2
• Filed: 01/23/2019
• Issued: 03/03/2020
• Est. Priority Date: 08/05/2016
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Lander, Vadim, Gupta, Lokesh
• Primary Examiner(s): Zhen, Wei Y
• Assistant Examiner(s): Wu, Junchun
• Application Number:
  US16/254,761
• Publication Number:
  US 20190155597A1
• Time in Patent Office: 405 Days
• CPC Class Codes: G06F 11/3664 Environments for testing or debugging software
• CPC Class Codes: G06F 11/3688 for test execution, e.g. scheduling of test suites
• CPC Class Codes: G06F 8/656 while running
• CPC Class Codes: H04L 45/02 Topology update or discovery
• CPC Class Codes: H04L 47/125 by balancing the load, e.g. traffic engineering
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations

Abstract

Embodiments implement data versioning in a cloud-based identity management system. Embodiments provide a first microservice for performing an identity management service and having a corresponding first version application programming interface (“API”) that identifies the first microservice. Embodiments provide a second microservice for performing the identity management service, the second microservice comprising a new version of the first microservice and having a corresponding second version API that identifies the second microservice. Embodiments receive a request for performing the identity management service from a client of the identity management system, the request including a uniform resource locator (“URL”), where the first version API or the second version API are identified in the URL. Embodiments then perform the identity management service using either the first microservice or the second microservice based on the request and using tenant data stored in a database.

Claims

1. A method of implementing data versioning in a cloud-based identity management system, the method comprising:

providing a first service for performing an identity management service and having a corresponding first version application programming interface (API) that identifies and is used to access the first service, the first service configured to work with a first version of a user resource type schema that defines a first number of attributes;

providing a second service for performing the identity management service, the second service comprising a new version of the first service and having a corresponding second version API that is different from the first version API and that identifies and is used to access the second service, the second service configured to work with a second version of the user resource type schema that defines a second number of attributes;

receiving a request for performing the identity management service from a client of the identity management system, the request comprises a uniform resource locator (URL), wherein the first version API or the second version API are identified in the URL; and

performing the identity management service using either the first service and the first version of the user resource type schema or the second service and the second version of the user resource type schema based on the request and using tenant data stored in a database.

2. The method of claim 1, wherein the new version of the first service comprises data versioning of the database used for the identity management service comprising attributes that are added or deprecated from previous versions of a schema of the database.

3. The method of claim 1, further comprising:

providing a resource manager as a common data access layer, the resource manager receiving the request from the client.

4. The method of claim 1, further comprising:

determining an upgrade to be applied to the first service to implement the second service, wherein the first service is in a first stateless middle tier in a first topology that includes a first web tier configured to route the request;

deploying a second topology that implements the upgrade, wherein the second topology includes a second stateless middle tier including the second service, wherein the second topology further includes a second web tier configured to route requests in the second topology;

testing the second service in the second topology using test data stored in the database;

promoting the second topology; and

draining and shutting down the first topology.

5. The method of claim 1, wherein a resource portion of the URL identifies the first version API or the second version API, and a host portion of the URL identifies a tenancy of a resource related to the request, and the first service and the second service comprise microservices.

6. The method of claim 1, wherein the identity management service comprises one of a login service, a single sign on (SSO) service, a federation service, a token service, a directory service, a provisioning service, or a role-based access control (RBAC) service.

7. The method of claim 4, wherein a public cloud load balancer routes the request to the first web tier in the first topology based on an indication of the API version in the request.

8. A cloud-based identity management system comprising:

a first service for performing an identity management service and having a corresponding first version application programming interface (API) that identifies and is used to access the first service, the first service configured to work with a first version of a user resource type schema that defines a first number of attributes;

a second service for performing the identity management service, the second service comprising a new version of the first service and having a corresponding second version API that is different from the first version API and that identifies and is used to access the second service, the second service configured to work with a second version of the user resource type schema that defines a second number of attributes;

a resource manager comprising a common data access layer, the resource manager receiving a request for performing the identity management service from a client of the identity management system, the request comprises a uniform resource locator (URL), wherein the first version API or the second version API are identified in the URL;

a database coupled to both the first service and the second service; and

either the first service using the first version of the user resource type schema or the second service using the second version of the user resource type schema configured to perform the identity management service based on the request and using tenant data stored in a database.

9. The system of claim 8, wherein the new version of the first service comprises data versioning of the database used for the identity management service comprising attributes that are added or deprecated from previous versions of a schema of the database.

10. The system of claim 8, further comprising one or more processors configured to:

determine an upgrade to be applied to the first service to implement the second service, wherein the first service is in a first stateless middle tier in a first topology that includes a first web tier configured to route the request;

deploy a second topology that implements the upgrade, wherein the second topology includes a second stateless middle tier including the second service, wherein the second topology further includes a second web tier configured to route requests in the second topology;

test the second service in the second topology using test data stored in the database;

promote the second topology; and

drain and shut down the first topology.

11. The system of claim 8, wherein a resource portion of the URL identifies the first version API or the second version API, and a host portion of the URL identifies a tenancy of a resource related to the request, and the first service and the second service comprise microservices.

12. The system of claim 8, wherein the identity management service comprises one of a login service, a single sign on (SSO) service, a federation service, a token service, a directory service, a provisioning service, or a role-based access control (RBAC) service.

13. The system of claim 10, further comprising a public cloud load balancer configured to route the request to the first web tier in the first topology based on an indication of the API version in the request.

14. The system of claim 13, wherein the public cloud load balancer is configured to provide a first virtual internet protocol (VIP) address pointing to origin servers of the first topology and a second VIP address pointing to origin servers of the second topology.

15. A non-transitory computer readable medium having instructions stored thereon that, when executed by a processor, cause the processor to provide versioning in a cloud-based identity management system, the versioning comprising:

providing a first service for performing an identity management service and having a corresponding first version application programming interface (API) that identifies and is used to access the first service, the first service configured to work with a first version of a user resource type schema that defines a first number of attributes;

providing a second service for performing the identity management service, the second service comprising a new version of the first service and having a corresponding second version API that is different from the first version API and that identifies and is used to access the second service, the second service configured to work with a second version of the user resource type schema that defines a second number of attributes;

receiving a request for performing the identity management service from a client of the identity management system, the request comprises a uniform resource locator (URL), wherein the first version API or the second version API are identified in the URL; and

performing the identity management service using either the first service and the first version of the user resource type schema or the second service and the second version of the user resource type schema based on the request and using tenant data stored in a database.

16. The computer readable medium of claim 15, wherein the new version of the first service comprises data versioning of the database used for the identity management service comprising attributes that are added or deprecated from previous versions of a schema of the database.

17. The computer readable medium of claim 15, the versioning further comprising:

providing a resource manager as a common data access layer, the resource manager receiving the request from the client.

18. The computer readable medium of claim 15, the versioning further comprising:

determining an upgrade to be applied to the first service to implement the second service, wherein the first service is in a first stateless middle tier in a first topology that includes a first web tier configured to route the request;

deploying a second topology that implements the upgrade, wherein the second topology includes a second stateless middle tier including the second service, wherein the second topology further includes a second web tier configured to route requests in the second topology;

testing the second service in the second topology using test data stored in the database;

promoting the second topology; and

draining and shutting down the first topology.

19. The computer readable medium of claim 15, wherein a resource portion of the URL identifies the first version API or the second version API, and a host portion of the URL identifies a tenancy of a resource related to the request, and the first service and the second service comprise microservices.

20. The computer readable medium of claim 15, wherein the identity management service comprises one of a login service, a single sign on (SSO) service, a federation service, a token service, a directory service, a provisioning service, or a role-based access control (RBAC) service.