System and method for supporting security in a multitenant application server environment

• US 9,578,009 B2
• Filed: 06/23/2015
• Issued: 02/21/2017
• Est. Priority Date: 06/23/2014
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Tancill, Jeff J., Hopkins, William S., Perez, Craig, Guy, David A., Bower, Peter, Li, Juan, Sriramadhesikan, Krishna
• Primary Examiner(s): McNally, Michael S
• Assistant Examiner(s): Le, Khoi
• Application Number:
  US14/747,778
• Publication Number:
  US 20150373004A1
• Time in Patent Office: 609 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/278 Data partitioning, e.g. horizontal or vertical partitioning
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: H04L 47/70 Admission control; Resource allocation
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

In accordance with an embodiment, described herein is a system and method for providing security in a multitenant application server environment. In accordance with an embodiment, per-partition security configuration includes: per-partition security realm (including configuration for authentication, authorization, credential mapping, auditing, password validation, certificate validation, and user lockout); SSL configuration, including keys, certificates, and other configuration attributes; and access control for partition and global resources. An administrator can designate one or more partition users as partition administrators, via grant of roles.

Claims

1. A method for providing security in a multitenant application server environment (MASE) comprising a plurality of partitions, a plurality of partition resources and a plurality of global resources, the method comprising:

defining a plurality of security realms in the MASE, including an admin security realm, a first security realm, and a second security realm;

configuring a first partition of the plurality of partitions of the MASE to have a first plurality of partition resources of the plurality of partition resources of the MASE;

configuring a second partition of the plurality of partitions of the MASE to have a second plurality of partition resources of the plurality of partition resources of the MASE;

providing a first security configuration associating the first partition with the first security realm;

providing a second security configuration associating the second partition with the second security realm;

associating a first primary identity domain with the first partition, wherein the first primary identity domain represents a first plurality of users associated with a first tenant;

associating each of the first plurality of partition resources of the MASE with the first primary identity domain;

associating a second primary identity domain with the second partition wherein the second primary identity domain represents a second plurality of users associated with a second tenant;

associating each of the second plurality of partition resources of the MASE with the second primary identity domain;

operating each of said admin security realm, first security realm, and second security realm simultaneously at runtime in the MASE to control authentication and authorization for access to said plurality of partition resources and said plurality of global resources;

wherein said operating step includes providing an authorization service in the MASE which in response to receiving a call from a user to access a partition resource of the plurality of partition resources compares a primary identity domain associated with said user to a primary identity domain associated with said partition resource and authorizes access to said partition resource only if the primary identity domain associated with said user matches the primary identity domain associated with said partition resource;

whereby the first plurality of users associated with the first tenant have access to the first plurality of partition resources of the first partition but not the second plurality of partition resources of the second partition; and

whereby the second plurality of users associated with the second tenant have access to the second plurality of partition resources of the second partition but not the first plurality of partition resources of the first partition.

2. The method of claim 1, further comprising:

configuring the first primary identity domain to reference a first identity store for storing a first representation of the first plurality of users associated with the first tenant; and

configuring the second primary identity domain to reference a second identity store, different than the first identity store, for storing a second representation of the second plurality of users associated with the second tenant.

3. The method of claim 1, further comprising:

configuring the first primary identity domain to reference a first portion of an identity store for storing a first representation of the first plurality of users associated with the first tenant; and

configuring the second primary identity domain to reference a second portion of said identity store for storing a second representation of the second plurality of users associated with the second tenant.

4. The method of claim 1, further comprising:

associating an admin identity domain with the multitenant application server environment, wherein the admin identity domain represents a plurality of system administrators of the multitenant application server environment; and

whereby the plurality of system administrators associated with the multitenant application server environment have access to said plurality of global resources.

5. The method of claim 1, further comprising:

providing a first authentication service configured to authenticate the first plurality of users associated with the first tenant and generate first signed principals identifying said first primary identity domain in combination with one or more of said first plurality of users.

6. The method of claim 1, further comprising:

providing a first authentication service configured to authenticate the first plurality of users associated with the first tenant and generate first signed principals identifying said first primary identity domain in combination with one or more of said first plurality of users; and

providing a second authentication service configured to authenticate the second plurality of users associated with the second tenant and generate second signed principals identifying said second primary identity domain in combination with one or more of said second plurality of users.

7. A non-transitory computer-readable medium including instructions stored thereon for providing security in a multitenant application server environment (MASE) comprising a plurality of partitions having a plurality of partition resources and a plurality of global resources, which instructions, when executed, cause a system to perform steps comprising:

defining a plurality of security realms in the MASE, including an admin security realm, a first security realm, and a second security realm;

configuring a first partition of the plurality of partitions of the MASE to have a first plurality of partition resources of the plurality of partition resources of the MASE;

configuring a second partition of the plurality of partitions of the MASE to have a second plurality of partition resources of the plurality of partition resources of the MASE;

providing a first security configuration associating the first partition with the first security realm;

providing a second security configuration associating the second partition with the second security realm;

associating a first primary identity domain with the first partition, wherein the first primary identity domain represents a first plurality of users associated with a first tenant;

associating each of the first plurality of partition resources of the MASE with the first primary identity domain;

associating a second primary identity domain with the second partition wherein the second primary identity domain represents a second plurality of users associated with a second tenant;

associating each of the second plurality of partition resources of the MASE with the second primary identity domain;

operating each of said admin security realm, first security realm, and second security realm simultaneously at runtime in the MASE to control authentication and authorization for access to said plurality of partition resources and said plurality of global resources;

wherein said operating step includes providing an authorization service in the MASE which in response to receiving a call from a user to access a partition resource of the plurality of partition resources compares a primary identity domain associated with said user to a primary identity domain associated with said partition resource and authorizes access to said partition resource only if the primary identity domain associated with said user matches the primary identity domain associated with said partition resource;

whereby the first plurality of users associated with the first tenant have access to the first plurality of partition resources of the first partition but not the second plurality of partition resources of the second partition; and

whereby the second plurality of users associated with the second tenant have access to the second plurality of partition resources of the second partition but not the first plurality of partition resources of the first partition.

8. The non-transitory computer-readable medium of claim 7 including further instructions stored thereon, which when executed, cause a system to perform further steps comprising:

configuring the first primary identity domain to reference a first identity store for storing a first representation of the first plurality of users associated with the first tenant; and

configuring the second primary identity domain to reference a second identity store, different than the first identity store, for storing a second representation of the second plurality of users associated with the second tenant.

9. The non-transitory computer-readable medium of claim 7 including further instructions stored thereon, which when executed, cause a system to perform further steps comprising:

configuring the first primary identity domain to reference a first portion of an identity store for storing a first representation of the first plurality of users associated with the first tenant; and

configuring the second primary identity domain to reference a second portion of said identity store for storing a second representation of the second plurality of users associated with the second tenant.

10. The non-transitory computer-readable medium of claim 7 including further instructions stored thereon, which when executed, cause a system to perform further steps comprising:

associating an admin identity domain with the multitenant application server environment, wherein the admin identity domain represents a plurality of system administrators of the multitenant application server environment; and

whereby the plurality of system administrators associated with the multitenant application server environment have access to said plurality of global resources.

11. The non-transitory computer-readable medium of claim 7 including further instructions stored thereon, which when executed, cause a system to perform further steps comprising:

providing a first authentication service configured to authenticate the first plurality of users associated with the first tenant and generate first signed principals identifying said first primary identity domain in combination with one or more of said first plurality of users.

12. The non-transitory computer-readable medium of claim 7 including further instructions stored thereon, which when executed, cause a system to perform further steps comprising:

providing a first authentication service configured to authenticate the first plurality of users associated with the first tenant and generate first signed principals identifying said first primary identity domain in combination with one or more of said first plurality of users; and

providing a second authentication service configured to authenticate the second plurality of users associated with the second tenant and generate second signed principals identifying said second primary identity domain in combination with one or more of said second plurality of users.

13. The non-transitory computer-readable medium of claim 7 including further instructions stored thereon, which when executed, cause a system to perform further steps comprising:

providing a first authentication service configured to authenticate the first plurality of users associated with the first tenant and generate first signed principals identifying said first primary identity domain in combination with one or more of said first plurality of users;

providing a second authentication service configured to authenticate the second plurality of users associated with the second tenant and generate second signed principals identifying said second primary identity domain in combination with one or more of said second plurality of users.

14. A multitenant application server environment system comprising:

an application server environment comprising a plurality of microprocessors and memory;

a plurality of partitions configured on said application server environment;

a plurality of partition resources and a plurality of global resources provided in said application server environment;

a plurality of security realms including an admin security realm, a first security realm, and a second security realm configured in said application server environment;

a first partition of the plurality of partitions configured to have a first plurality of partition resources of the plurality of partition resources;

a second partition of the plurality of partitions configured to have a second plurality of partition resources of the plurality of partition resources;

a first security configuration associating the first partition with the first security realm;

a second security configuration associating the second partition with the second security realm;

a first primary identity domain associated with the first partition, wherein the first primary identity domain represents a first plurality of users associated with a first tenant, and wherein the first plurality of partition resources is associated with the first primary identity domain;

a second primary identity domain associated with the second partition wherein the second primary identity domain represents a second plurality of users associated with a second tenant, and wherein the second plurality of partition resources is associated with the second primary identity domain;

an authorization service, provided by said application server environment, which in response to receiving a call from a user to access a partition resource of the plurality of partition resources compares a primary identity domain associated with said user to a primary identity domain associated with said partition resource and authorizes access to said partition resource only if the primary identity domain associated with said user matches the primary identity domain associated with said partition resource;

wherein said admin security realm, first security realm, and second security realm are configured to operate simultaneously at runtime to control authentication and authorization for access to said plurality of partition resources and said plurality of global resources;

whereby the first plurality of users associated with the first tenant have access to the first plurality of partition resources of the first partition but not the second plurality of partition resources of the second partition; and

whereby the second plurality of users associated with the second tenant have access to the second plurality of partition resources of the second partition but not the first plurality of partition resources of the first partition.

15. The system of claim 14, wherein:

the first primary identity domain is configured to reference a first identity store for storing a first representation of the first plurality of users associated with the first tenant; and

the second primary identity domain is configured to reference a second identity store, different than the first identity store, for storing a second representation of the second plurality of users associated with the second tenant.

16. The system of claim 14, wherein:

the first primary identity domain is configured to reference a first portion of an identity store for storing a first representation of the first plurality of users associated with the first tenant; and

the second primary identity domain is configured to reference a second portion of said identity store for storing a second representation of the second plurality of users associated with the second tenant.

17. The system of claim 14, further comprising:

an admin identity domain associated with the multitenant application server environment, wherein the admin identity domain represents a plurality of system administrators of the multitenant application server environment; and

whereby the plurality of system administrators associated with the multitenant application server environment have access to said plurality of global resources.

18. The system of claim 14, further comprising:

a first authentication service configured to authenticate the first plurality of users associated with the first tenant and generate first signed principals identifying said first primary identity domain in combination with one or more of said first plurality of users.

19. The system of claim 14, further comprising:

a first authentication service configured to authenticate the first plurality of users associated with the first tenant and generate first signed principals identifying said first primary identity domain in combination with one or more of said first plurality of users; and

a second authentication service configured to authenticate the second plurality of users associated with the second tenant and generate second signed principals identifying said second primary identity domain in combination with one or more of said second plurality of users.