Multi-tenancy identity management system

• US 10,581,867 B2
• Filed: 02/11/2016
• Issued: 03/03/2020
• Est. Priority Date: 09/07/2012
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Srinivasan, Uppili, Asokkumar, Vasukiammaiyar
• Primary Examiner(s): Lesniewski, Victor
• Application Number:
  US15/041,972
• Publication Number:
  US 20160173475A1
• Time in Patent Office: 1,482 Days
• CPC Class Codes: G06Q 10/06315 Needs-based resource requirements planning or analysis
• CPC Class Codes: H04L 41/5054 Automatic deployment of services triggered by the service manager, e.g. service implementation by automatic configuration of network components
• CPC Class Codes: H04L 47/70 Admission control; Resource allocation
• CPC Class Codes: H04L 47/83 based on usage prediction
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/104 Grouping of entities

Abstract

A multi-tenant identity management (IDM) system enables IDM functions to be performed relative to various different customers'"'"' domains within a shared cloud computing environment and without replicating a separate IDM system for each separate domain. The IDM system can provide IDM functionality to service instances located within various different customers'"'"' domains while enforcing isolation between those domains. A cloud-wide identity store can contain identity information for multiple customers'"'"' domains, and a cloud-wide policy store can contain security policy information for multiple customers'"'"' domains. The multi-tenant IDM system can provide a delegation model in which a domain administrator can be appointed for each domain, and in which each domain administrator can delegate certain roles to other user identities belong to his domain. Service instance-specific administrators can be appointed by a domain administrator to administer to specific service instances within a domain.

Claims

1. A computer-implemented method comprising:

creating, in a multi-tenant computing environment including a plurality of computing devices providing services to a plurality of customers, a first identity domain using an identity management (IDM) system configured to authenticate identities of users and authorize access to system resources, wherein the multi-tenant computing environment is a cloud computing environment, and wherein the identity management system is partitioned into a plurality of identity domains;

binding the first identity domain, that is created for a first customer of the plurality of customers, to identification information comprising a first uniform resource locator (URL) that is associated with the first identity domain, and wherein the first URL provides the first customer access to the first identity domain and services of the first identity domain;

associating, using the identity management system, a first plurality of services and one or more policies associated with a host machine for accessing the first plurality of services with the first identity domain, wherein associating the first plurality of services with the first identity domain comprises provisioning an instance of a service from among the first plurality of services to the first identity domain, and wherein access to the first plurality of services associated with the first identity domain is provided via the first URL when the customer satisfies the one or more policies associated with the host machine;

storing, in a first partition of a centralized identity store of the identity management system, identities and identity definitions of a first set of users using the identity management system;

associating, using the identity management system, the identities of the first set of users with the first plurality of services;

creating, in the multi-tenant computing environment using the identity management system, a second identity domain for the first customer that is isolated from the first identity domain, wherein the second identity domain comprises a second uniform resource locator (URL) that is associated with the second identity domain, and wherein the second URL provides the first customer access to the second identity domain;

associating, using the identity management system, a second plurality of services and one or more policies for accessing the second plurality of services with the second identity domain, wherein associating the second plurality of services with the second identity domain comprises provisioning an instance of a service from among the second plurality of services to the second identity domain;

storing, in a second partition of the centralized identity store, identities and identity definitions of a second set of users using the identity management system, wherein the second set of users is different from the first set of users; and

associating, using the identity management system, the identities of the second set of users with the second plurality of services.

2. The computer-implemented method of claim 1, further comprising:

assigning, to a first user of the first set of users, an identity domain administrator role that gives the first user a capability to assign, to other users in the first set of users, service administrator roles or an identity administrator role within the first identity domain.

3. The computer-implemented method of claim 2, further comprising:

assigning, by the first user to a second user of the first set of users, a first service administrator role that gives the second user a capability to administer a first service of the first plurality of services.

4. The computer-implemented method of claim 3, further comprising:

assigning, by the second user to a third user of the first set of users, a service-specific role for the first service, the service-specific role including one of a user role, a developer role, or an administrator role.

5. The computer-implemented method of claim 2, further comprising:

assigning, by the first user to a second user of the first set of users, an identity domain security administrator role that gives the second user a capability to administer users and roles in the first identity domain.

6. The computer-implemented method of claim 5, further comprising:

assigning, by the second user to a third user of the first set of users, a role for managing users in the first identity domain or a role for managing roles in the first identity domain.

7. The computer-implemented method of claim 1, further comprising:

mapping, using the identity management system, a first user of the first set of users to a first set of access permissions for a first subset of the first plurality of services; and

mapping, using the identity management system, a second user of the first set of users to a second set of access permissions for a second subset of the first plurality of services.

8. The computer-implemented method of claim 7, wherein the mapping is constructed using at least one of roles, groups, or rules associated with the first identity domain.

9. The computer-implemented method of claim 8, wherein the roles are stored as identities in the centralized identity store of the identity management system along with permissions granted to each of the roles.

10. The computer-implemented method of claim 1, further comprising:

creating, in an operation identity domain of the multi-tenant computing environment, an account for a customer of the plurality of customers, wherein at least one of the first identity domain or the second identity domain is created using the account.

11. The computer-implemented method of claim 10, further comprising:

assigning, by the customer, at least one of an identity domain administrator or a service administrator for the first or second identity domain.

12. The computer-implemented method of claim 1, further comprising:

binding a name to each of the first identity domain and the second identity domain.

13. The computer-implemented method of claim 1, further comprising:

storing, in the centralized identity store, the identities of the first set of users within a first partition of a lightweight access protocol (LDAP) directory that is partitioned by identity domain; and

storing, in the centralized identity store, the identities of the second set of users within a second partition of the LDAP directory.

14. The computer-implemented method of claim 1, further comprising:

creating, using the identity management system, a plurality of policies associated with the first identity domain in a policy store of the identity management system, wherein each policy of the plurality of policies includes a set of rules; and

storing the plurality of policies associated with the first identity domain in a first partition of the policy store.

15. The computer-implemented method of claim 14, wherein the policy store includes an LDAP tree comprising a plurality of sub-trees, each sub-tree corresponding to a partition for each identity domain.

16. The computer-implemented method of claim 14, further comprising:

executing a run-time instance to enforce the plurality of policies associated with the first identity domain.

17. The computer-implemented method of claim 1, further comprising:

receiving a request to add a service to the first plurality of services;

adding an instance of the service to the first plurality of services in response to the request; and

associating the instance of the service with the first partition of the centralized identity store that stores the identities of the first set of users.

18. The computer-implemented method of claim 17, further comprising:

defining, within the first identity domain, a hierarchy of roles that is automatically selected from multiple hierarchies of roles, based on a type of the service; and

assigning the hierarchy of roles for the instance of the service to the first set of users.

19. The computer-implemented method of claim 1, wherein the first plurality of services includes at least one of:

online data storage and backup solutions, web-based e-mail services, hosted office suites and document collaboration services, database processing, managed technical support service, or services provided under Software as a Service (SaaS) category, Platform as a Service (PaaS) category, or Infrastructure as a Service (IaaS) category.

20. The computer-implemented method of claim 1, wherein associating the identities of the first set of users with the first plurality of services comprises:

enabling sharing of an instance of a service from the first plurality of services among the first set of users.

21. The method according to claim 1, wherein the identity management system is virtually partitioned for each tenant in the multi-tenant computing environment.

22. The method according to claim 1, wherein the first set of users corresponding to the identities in the first partition of the centralized identity store and the second set of users corresponding to the identities in the second partition of the centralized identity store share a same instance of the identity management system.

23. The method according to claim 1, wherein the identification information is configured to be selected in response to a single sign-on (SSO) by the first customer.

24. The method according to claim 1, wherein the cloud computing environment comprises a cloud security foundation layer configured to create a hierarchy of roles, a cloud shared IDM layer configured to provide a model for isolating data for each of a plurality of tenants in the multi-tenant computing environment, and a security layer for security management of each of the plurality of customers in the IDM system.

25. The method according to claim 1, wherein the first URL is bound to the first identity domain and the second URL is bound to the second identity domain.

26. A non-transitory computer-readable storage medium storing instructions, the instructions, when executed by one or more processors, causing the one or more processors to:

create, in a multi-tenant computing environment including a plurality of computing devices providing services to a plurality of customers, a first identity domain using an identity management (IDM) system configured to authenticate identities of users and authorize access to system resources, wherein the multi-tenant computing environment is a cloud computing environment, and wherein the identity management system is partitioned into a plurality of identity domains;

bind the first identity domain, that is created for a first customer of the plurality of customers, to identification information comprising a first uniform resource locator (URL) that is associated with the first identity domain and wherein the first URL provides the first customer access to the first identity domain and services of the first identity domain;

associate, using the identity management system, a first plurality of services and one or more policies associated with a host machine for accessing the first plurality of services with the first identity domain, wherein associating the first plurality of services with the first identity domain comprises provisioning an instance of a service from among the first plurality of services to the first identity domain, and wherein access to the first plurality of services associated with the first identity domain is provided via the first URL when the customer satisfies the one or more policies associated with the host machine;

store, in a first partition of a centralized identity store of the identity management system, identities and identity definitions of a first set of users using the identity management system;

associate, using the identity management system, the identities of the first set of users with the first plurality of services;

create, in the multi-tenant computing environment using the identity management system, a second identity domain for the first customer that is isolated from the first identity domain, wherein the second identity domain comprises a second uniform resource locator (URL) that is associated with the second identity domain, and wherein the second URL provides the first customer access to the second identity domain;

associate, using the identity management system, a second plurality of services and one or more policies for accessing the second plurality of services with the second identity domain, wherein associating the second plurality of services with the second identity domain comprises provisioning an instance of a service from among the second plurality of services to the second identity domain;

store, in a second partition of the centralized identity store, identities and identity definitions of a second set of users using the identity management system, wherein the second set of users is different from the first set of users; and

associate, using the identity management system, the identities of the second set of users with the second plurality of services.

27. A system comprising:

one or more processors; and

a computer-readable storage memory that stores instructions comprising;

creating, in a multi-tenant computing environment including a plurality of computing devices providing services to a plurality of customers, a first identity domain using an identity management (IDM) system configured to authenticate identities of users and authorize access to system resources, wherein the multi-tenant computing environment is a cloud computing environment, and wherein the identity management system is partitioned into a plurality of identity domains;

binding the first identity domain, that is created for a first customer of the plurality of customers, to identification information comprising a first uniform resource locator (URL) that is associated with the first identity domain, and wherein the first URL provides the first customer access to the first identity domain and services of the first identity domain;

associating, using the identity management system, a first plurality of services and one or more policies associated with a host machine for accessing the first plurality of services with the first identity domain, wherein associating the first plurality of services with the first identity domain comprises provisioning an instance of a service from among the first plurality of services to the first identity domain, and wherein access to the first plurality of services associated with the first identity domain is provided via the first URL when the customer satisfies the one or more policies associated with the host machine;

storing, in a first partition of a centralized identity store of the identity management system, identities and identity definitions of a first set of users using the identity management system;

associating, using the identity management system, the identities of the first set of users with the first plurality of services;

creating, in the multi-tenant computing environment using the identity management system, a second identity domain for the first customer that is isolated from the first identity domain, wherein the second identity domain comprises a second uniform resource locator (URL) that is associated with the second identity domain, and wherein the second URL provides the first customer access to the second identity domain;

associating, using the identity management system, a second plurality of services and one or more policies for accessing the second plurality of services with the second identity domain, wherein associating the second plurality of services with the second identity domain comprises provisioning an instance of a service from among the second plurality of services to the second identity domain;

storing, in a second partition of the centralized identity store, identities and identity definitions of a second set of users using the identity management system, wherein the second set of users is different from the first set of users; and

associating, using the identity management system, the identities of the second set of users with the second plurality of services.