MULTI-TENANCY IDENTITY MANAGEMENT SYSTEM

• US 20140075565A1
• Filed: 03/15/2013
• Published: 03/13/2014
• Est. Priority Date: 09/07/2012
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Srinivasan, Uppili, Asokkumar, Vasukiammaiyar
• Granted Patent: US 9,276,942 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06Q 10/06315 Needs-based resource requirements planning or analysis
• CPC Class Codes: H04L 41/5054 Automatic deployment of services triggered by the service manager, e.g. service implementation by automatic configuration of network components
• CPC Class Codes: H04L 47/70 Admission control; Resource allocation
• CPC Class Codes: H04L 47/83 based on usage prediction
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/104 Grouping of entities

Abstract

A multi-tenant identity management (IDM) system enables IDM functions to be performed relative to various different customers'"'"' domains within a shared cloud computing environment and without replicating a separate IDM system for each separate domain. The IDM system can provide IDM functionality to service instances located within various different customers'"'"' domains while enforcing isolation between those domains. A cloud-wide identity store can contain identity information for multiple customers'"'"' domains, and a cloud-wide policy store can contain security policy information for multiple customers'"'"' domains. The multi-tenant IDM system can provide a delegation model in which a domain administrator can be appointed for each domain, and in which each domain administrator can delegate certain roles to other user identities belong to his domain. Service instance-specific administrators can be appointed by a domain administrator to administer to specific service instances within a domain.

Claims

1. A computer-implemented method comprising:

creating a first identity domain through a shared identity management system;

associating a first plurality of services with the first identity domain;

sharing, among the first plurality of services, identities of a first set of users managed by the shared identity management system;

creating, through the shared identity management system, a second identity domain that is isolated from the first identity domain;

associating a second plurality of services with the second identity domain; and

sharing, among the second plurality of services, identities of a second set of users managed by the shared identity management system.

2. The computer-implemented method of claim 1, further comprising:

mapping, through the shared identity management system, (a) a first user of the first set of users to (b) first access permissions for a subset of the first plurality of services;

mapping, through the shared identity management system, (c) a second user of the second set of users to (d) second access permissions for a subset of the second plurality of services.

3. The computer-implemented method of claim 1, further comprising:

mapping, through the shared identity management system, (a) a first user of the first set of users to (b) a first role that is mapped to first access permissions for a subset of the first plurality of services;

mapping, through the shared identity management system, (c) a second user of the second set of users to (d) a second role that is mapped to second access permissions for a subset of the second plurality of services.

4. The computer-implemented method of claim 1, further comprising:

preventing users in the first set of users from performing operations relative to services that in the second set of services but not in the first set of services;

preventing users in the second set of users from performing operations relative to services that in the first set of services but not in the second set of services;

allowing operations users to perform operations relative to both services that are in the first set of services and services that are in the second set of services.

5. The computer-implemented method of claim 1, further comprising:

storing the identities of the first set of users within a first partition of a lightweight access protocol (LDAP) directory that is partitioned by identity domain; and

storing the identities of the second set of users within a second partition of the LDAP directory.

6. The computer-implemented method of claim 1, further comprising:

presenting a user interface that includes a user interface element through which a particular user can identify, as a part of a login process, a particular identity domain to which the particular user is attempting to gain access.

7. The computer-implemented method of claim 1, further comprising:

presenting a console that provides controls for adding user identities to and removing user identities from an identity domain;

receiving a command through the console from an identity domain administrator;

determining a particular identity domain to which the identity domain administrator belongs; and

restricting user identity addition and removal operations performed by the identity domain administrator through the console to the particular identity domain.

8. The computer-implemented method of claim 1, further comprising:

assigning, to a first user of the first set of users, an identity domain administrator role that gives the first user a capability to assign, to other users in the first set of users, service administrator roles;

assigning, to a second user of the first set of users selected by the first user in an identity domain administrator capacity, a first service administrator role that gives the second user a capability to administer a first service of the first plurality of services; and

assigning, to a third user of the first set of users selected by the first user in the identity domain administrator capacity, a second service administrator role that gives the third user a capability to administer a second service of the first plurality of services.

9. The computer-implemented method of claim 1, further comprising:

receiving, from a first person who does not have a user identity in the first identity domain, but who is associated with an account through which the first identity domain was purchased, an e-mail address of a second person who also does not have a user identity in the first identity domain;

receiving, from the first person, a role to which the first person is nominating the second person within the first identity domain;

sending, to the e-mail address of the second person, an e-mail message containing a hyperlink to a web-based form usable to create a user identity within the first identity domain;

adding an identity of the second person to the identities of the first set of users based on information that the second person supplied through the web-based form; and

assigning the role to the identity of the second person within the first identity domain.

10. The computer-implemented method of claim 1, further comprising:

receiving a request to add a particular service to the first set of services;

adding the particular service to the first set of services in response to the request; and

defining, within the first identity domain, a hierarchy of roles that is automatically selected from multiple hierarchies of roles based on a type of the particular service.

11. The computer-implemented method of claim 1, further comprising:

binding a particular service instance that is an instance of a service in the first set of services to a first partition of an identity store that stores identities for multiple identity domains defined in a cloud computing environment; and

binding the particular service instance to a second partition of a policy store that stores policies for multiple service instances belonging to different identity domains defined in the cloud computing environment;

wherein the first partition contains only identities that belong to the first identity domain;

wherein the second partition contains only policies that pertain to the particular service instance.

12. A computer-readable storage memory storing particular instructions capable of causing one or more processors to perform specified operations, the particular instructions comprising:

instructions to create a plurality of identity domains within a cloud computing environment;

instructions to enforce isolation between identity domains within the plurality of identity domains;

instructions to add a service instance to a particular identity domain of the plurality of identity domains;

instructions to store data associating the service instance with a particular partition of an identity store that stores identities for each identity domain of the plurality of identity domains; and

instructions to store data associating the service instance with a particular partition of a policy store that stores policies for a plurality of services instances that are associated with different identity domains of the plurality of identity domains.

13. The computer-readable storage memory of claim 12, wherein the particular instructions further comprise:

instructions to assign a first role, from a hierarchy of roles, to a first user having a first user identity that is stored in the identity store and associated with the particular identity domain;

wherein the first role is a role that allows users having the first role to manage all service instances that are associated with the particular identity domain;

instructions to assign a second role, from the hierarchy of roles, to a second user having a second user identity that is stored in the identity store;

wherein the second role is a role that allows users having the second role to manage a single service instance that is associated with the particular identity domain.

14. The computer-readable storage memory of claim 13, wherein the instructions to assign the second role to the second user comprise instructions to assign the second role to the second user in response to the first user delegating the second role to the second user.

15. The computer-readable storage memory of claim 13, wherein the instructions to add the service instance to the particular identity domain of the plurality of identity domains comprise instructions to assign, to a third user having a third identity that is stored in the identity store and associated with the particular identity domain, a third role that is defined by a plurality of roles that are associated with a type of the particular service instance.

16. The computer-readable storage memory of claim 15, wherein the particular instructions comprise instructions to cause the second role to inherit all permissions that are associated with the third role;

and wherein the particular instructions comprise instructions to cause the first role to inherit all permissions that are inherited by the second role.

17. The computer-readable storage memory of claim 12, wherein the instructions to create the plurality of identity domains within the cloud computing environment comprise instructions to create the particular identity domain within the cloud computing environment;

and wherein the instructions to create the particular identity domain within the cloud computing environment comprise instructions to send, to a specified e-mail address, an e-mail message providing a mechanism whereby a recipient of the e-mail message can establish an administrative identity within the particular identity domain.

18. A system comprising:

one or more processors; and

a computer-readable storage memory that stores particular instructions comprising;

instructions to cause a single identity management (IDM) system to be established in a cloud computing environment;

instructions to cause the single IDM system to provide IDM functions to a first service instance that is associated with a first identity domain that is defined within the cloud computing environment and that is isolated from a second identity domain that is defined within the cloud computing environment; and

instructions to cause the single IDM system to provide IDM functions to a second service instance that is associated with the second identity domain.

19. The system of claim 18, wherein the particular instructions further comprise:

instructions to cause the single IDM system to store user identities associated with the first identity domain but not the second identity domain within a single identity store that is maintained within the cloud computing environment;

instructions to cause the single IDM system to store user identities associated with the second identity domain but not the first identity domain within the single identity store;

instructions that cause the single IDM system to generate a first credential that permits the first service instance to interact with a portion of the single identity store that contains user identities that are associated with the first identity domain but not with portions of the single identity store that contain user identities that are not associated with the first identity domain; and

instructions that cause the single IDM system to generate a second credential that permits the second service instance to interact with a portion of the single identity store that contains user identities that are associated with the second identity domain but not with portions of the single identity store that contain user identities that are not associated with the second identity domain.

20. The system of claim 18, wherein the particular instructions further comprise:

instructions to cause the single IDM system to store security access policies that are associated with the first service instance but not the second service instance within a single policy store that is maintained within the cloud computing environment;

instructions to cause the single IDM system to store security access policies that are associated with the second service instance but not the first service instance within the single policy store;

instructions that cause the single IDM system to generate a first credential that permits the first service instance to interact with a portion of the single policy store that contains security access policies that are associated with the first service instance but not with portions of the single policy store that contain security access policies that are not associated with the first service instance; and

instructions that cause the single IDM system to generate a second credential that permits the second service instance to interact with a portion of the single policy store that contains security access policies that are associated with the second service instance but not with portions of the single policy store that contain security access policies that are not associated with the second service instance.