MICROSERVICES BASED MULTI-TENANT IDENTITY AND DATA SECURITY MANAGEMENT CLOUD SERVICE

• US 20180097802A1
• Filed: 11/17/2017
• Published: 04/05/2018
• Est. Priority Date: 05/11/2016
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: LANDER, Vadim, CARRU, Damien, COLE, Gary P., SONDHI, Ajay, WILSON, Gregg
• Granted Patent: US 10,200,358 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

A system provides cloud-based identity and access management. The system receives a request for performing an identity management service, where the request includes a call to an application programming interface (“API”) that identifies the identity management service and a microservice configured to perform the identity management service. The system authenticates the request, accesses the microservice, and performs the identity management service by the microservice.

Claims

1. A method of providing cloud-based identity services for a plurality of tenants, the method comprising:

receiving a request for performing an identity management service, wherein the request comprises an application programming interface (API) that corresponds to a microservice configured to perform the identity management service;

accessing the microservice; and

performing the identity management service by the microservice.

2. The method of claim 1, wherein the request comprises a uniform resource locator (URL), wherein the microservice is identified in a prefix of the URL, wherein a resource portion of the URL identifies the API, wherein a host portion of the URL identifies a tenancy of a resource related to the request.

3. The method of claim 1, wherein the microservice is stateless, horizontally scalable, and independently deployable.

4. The method of claim 1, wherein each physical implementation of the microservice is configured to securely support multiple tenants.

5. The method of claim 1, wherein the identity management service comprises a login service, a single sign on (SSO) service, a federation service, a token service, a directory service, a provisioning service, or a role-based access control (RBAC) service.

6. The method of claim 1, wherein communication with the microservice is configured according to a lightweight protocol.

7. The method of claim 6, wherein the lightweight protocol comprises a Hypertext Transfer Protocol (HTTP) and a Representational State Transfer (REST) protocol, wherein the request comprises a call to a RESTful HTTP API.

8. The method of claim 1, wherein the microservice performs the identity management service based on tenant data stored in a database, wherein the database and the microservice are configured to scale independently of one another.

9. The method of claim 8, wherein the database comprises a distributed data grid.

10. A cloud-based identity management system comprising:

a plurality of processors and instructions that, when executed by the processor, cause at least one of the processors to;

receive a request for performing an identity management service, wherein the request comprises an application programming interface (API) that corresponds to a microservice configured to perform the identity management service;

access the microservice; and

perform the identity management service by the microservice.

11. The system of claim 10, wherein the request comprises a uniform resource locator (URL), wherein the microservice is identified in a prefix of the URL, wherein a resource portion of the URL identifies the API, wherein a host portion of the URL identifies a tenancy of a resource related to the request.

12. The system of claim 10, wherein the microservice is stateless, horizontally scalable, and independently deployable.

13. The system of claim 10, wherein each physical implementation of the microservice is configured to securely support multiple tenants.

14. The system of claim 10, wherein the identity management service comprises a login service, a single sign on (SSO) service, a federation service, a token service, a directory service, a provisioning service, or a role-based access control (RBAC) service.

15. A non-transitory computer readable medium having instructions stored thereon that, when executed by a processor, cause the processor to provide cloud-based identity services for a plurality of tenants, the providing comprising:

receiving a request for performing an identity management service, wherein the request comprises an application programming interface (API) that corresponds to a microservice configured to perform the identity management service;

accessing the microservice; and

performing the identity management service by the microservice.

16. The computer readable medium of claim 15, wherein the request comprises a uniform resource locator (URL), wherein the microservice is identified in a prefix of the URL, wherein a resource portion of the URL identifies the API, wherein a host portion of the URL identifies a tenancy of a resource related to the request.

17. The computer readable medium of claim 15, wherein each physical implementation of the microservice is configured to securely support multiple tenants.

18. The computer readable medium of claim 15, wherein the identity management service comprises a login service, a single sign on (SSO) service, a federation service, a token service, a directory service, a provisioning service, or a role-based access control (RBAC) service.

19. The computer readable medium of claim 15, wherein communication with the microservice is configured according to a lightweight protocol that comprises a Hypertext Transfer Protocol (HTTP) and a Representational State Transfer (REST) protocol, wherein the request comprises a call to a RESTful HTTP API.

20. The computer readable medium of claim 15, wherein the microservice performs the identity management service based on tenant data stored in a database, wherein the database and the microservice are configured to scale independently of one another.