TENANT SELF-SERVICE TROUBLESHOOTING FOR A MULTI-TENANT IDENTITY AND DATA SECURITY MANAGEMENT CLOUD SERVICE

• US 20180039501A1
• Filed: 07/12/2017
• Published: 02/08/2018
• Est. Priority Date: 08/05/2016
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: JAIN, Vikrant, GUPTA, Ashish, COLE, Gary P., LANDER, Vadim
• Granted Patent: US 10,585,682 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0769 Readable error formats, e.g. cross-platform generic formats, human understandable formats
• CPC Class Codes: G06F 11/0787 Storage of error reports, e.g. persistent data storage, storage using memory protection
• CPC Class Codes: G06F 9/451 Execution arrangements for user interfaces
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A system provides cloud-based identity and access management. The system provides a user interface (“UI”) to a tenant of an identity-management service. The system enables diagnostics functionality for the tenant based on a user input received via the UI, where the diagnostics functionality allows for a user in the tenant to configure and receive diagnostics reports related to the identity-management service. The system then receives a request for the identity-management service, accesses a microservice based on the request, performs the identity-management service by the microservice, collects and records diagnostics information during the performing of the identity-management service, and displays the diagnostics information to the user via the UI.

Claims

1. A non-transitory computer readable medium having instructions stored thereon that, when executed by a processor, cause the processor to provide cloud-based identity and access management, the providing comprising:

providing a user interface (UI) to a tenant of an identity-management service;

enabling diagnostics functionality for the tenant based on a user input received via the UI, wherein the diagnostics functionality allows for a user in the tenant to configure and receive diagnostics reports related to the identity-management service;

receiving a request for the identity-management service;

accessing a microservice based on the request;

performing the identity-management service by the microservice;

collecting and recording diagnostics information during the performing of the identity-management service; and

displaying the diagnostics information to the user via the UI.

2. The computer readable medium of claim 1, wherein the enabling of the diagnostics functionality for the tenant allows for the user in the tenant to configure and receive the diagnostics reports related to the tenant but does not allow the user to configure or receive other diagnostics reports related to other tenants that use the microservice.

3. The computer readable medium of claim 1, the providing further comprising disabling the diagnostics functionality for the tenant based on another user input received via the UI.

4. The computer readable medium of claim 1, wherein the microservice is stateless, wherein the microservice performs the identity-management service using data stored in a remote cache, wherein the remote cache comprises a distributed data grid, wherein the remote cache and the microservice are configured to scale independently of one another.

5. The computer readable medium of claim 4, wherein the remote cache implements a different namespace for each tenant that uses the microservice.

6. The computer readable medium of claim 1, wherein the diagnostics functionality is implemented by a diagnostics client and a diagnostics server, wherein the diagnostics client is invoked by the microservice, wherein the diagnostics server runs on an administration microservice.

7. The computer readable medium of claim 6, wherein communication between the diagnostics client and the diagnostics server is performed over Representational State Transfer (REST) protocol using an authentication token with administrative level privileges.

8. The computer readable medium of claim 6, wherein the diagnostics client collects the diagnostics information and pushes it to the diagnostics server, wherein the diagnostics server saves the diagnostics information in a storage.

9. The computer readable medium of claim 8, wherein, upon determining that the user wants to access the diagnostics information, the UI makes a corresponding call to the diagnostics service, wherein the diagnostics service performs a search on the stored diagnostics information and provides the required information to the UI.

10. The computer readable medium of claim 1, wherein each entry in the diagnostics information includes a timestamp and an execution-context identifier ECID, and a relationship identifier RID, wherein each entry in the diagnostics information further includes an actor name if applicable.

11. The computer readable medium of claim 10, wherein a traffic director generates the ECID for the request, wherein the ECID uniquely identifies the request.

12. The computer readable medium of claim 10, wherein the request forms the root of a tree of sub-tasks that need to be completed for the request, wherein the RID comprises an ordered set of numbers that describes a location of a task in the tree of sub-tasks, wherein the diagnostics information relates to the sub-task.

13. A method of cloud-based identity and access management, comprising:

providing a user interface (UI) to a tenant of an identity-management service;

enabling diagnostics functionality for the tenant based on a user input received via the UI, wherein the diagnostics functionality allows for a user in the tenant to configure and receive diagnostics reports related to the identity-management service;

receiving a request for the identity-management service;

accessing a microservice based on the request;

performing the identity-management service by the microservice;

collecting and recording diagnostics information during the performing of the identity-management service; and

displaying the diagnostics information to the user via the UI.

14. The method of claim 13, wherein the enabling of the diagnostics functionality for the tenant allows for the user in the tenant to configure and receive the diagnostics reports related to the tenant but does not allow the user to configure or receive other diagnostics reports related to other tenants that use the microservice.

15. The method of claim 13, the providing further comprising disabling the diagnostics functionality for the tenant based on another user input received via the UI.

16. The method of claim 13, wherein the microservice is stateless, wherein the microservice performs the identity-management service using data stored in a remote cache, wherein the remote cache comprises a distributed data grid, wherein the remote cache and the microservice are configured to scale independently of one another.

17. The method of claim 16, wherein the remote cache implements a different namespace for each tenant that uses the microservice.

18. The method of claim 13, wherein the diagnostics functionality is implemented by a diagnostics client and a diagnostics server, wherein the diagnostics client is invoked by the microservice, wherein the diagnostics server runs on an administration microservice.

19. The method of claim 18, wherein communication between the diagnostics client and the diagnostics server is performed over Representational State Transfer (REST) protocol using an authentication token with administrative level privileges.

20. A system for cloud-based identity and access management, comprising:

a providing module that provides a user interface (UI) to a tenant of an identity-management service;

an enabling module that enables diagnostics functionality for the tenant based on a user input received via the UI, wherein the diagnostics functionality allows for a user in the tenant to configure and receive diagnostics reports related to the identity-management service;

a receiving module that receives a request for the identity-management service;

an accessing module that accesses a microservice based on the request;

a performing module that performs the identity-management service by the microservice;

a collecting and recording module that collects and records diagnostics information during the performing of the identity-management service; and

a displaying module that displays the diagnostics information to the user via the UI.