Cookie based state propagation for a multi-tenant identity cloud service

• US 10,445,395 B2
• Filed: 09/12/2017
• Issued: 10/15/2019
• Est. Priority Date: 09/16/2016
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Carru, Damien, Uchil, Mrudul P., Sankesara, Bhavik, Xia, Risheng
• Primary Examiner(s): Truong, Lan Dai T
• Application Number:
  US15/701,968
• Publication Number:
  US 20180081983A1
• Time in Patent Office: 763 Days
• Field of Search: 709203, 709202, 709217, 709218, 709219
• CPC Class Codes: G06F 16/9566 URL specific, e.g. using aliases, detecting broken or misspelled links
• CPC Class Codes: G06F 16/957 Browsing optimisation, e.g. caching or content distillation
• CPC Class Codes: G06F 16/9574 of access to content, e.g. by caching
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/53 using third party service providers
• CPC Class Codes: H04L 67/5682 Policies or rules for updating, deleting or replacing the stored data

Abstract

A system that provides cloud based identity management, at a first microservice, saves a current state on a cookie that is stored on a browser, where the current state is saved in a format specific to the first microservice. The system performs an operation on the first microservice that generates a first portion of information and a second portion of information. The system stores the first portion of information related to the operation on the cookie, the first portion including the current state. The system provides a second portion of information related to the operation to a second microservice as a query parameter on a redirect Uniform Resource Locator (“URL”), where the second portion is removed from the cookie.

Claims

1. A non-transitory computer readable medium having instructions stored thereon that, when executed by a processor, cause the processor to provide cloud based identity management, the providing comprising:

at a first microservice, saving a current state on a cookie that is stored on a browser, wherein the current state is saved in a format specific to the first microservice;

performing an operation, on the first microservice, that generates a first portion of information and a second portion of information;

storing the first portion of information, related to the operation, on the cookie, the first portion comprising the current state; and

providing a second portion of information, related to the operation, to a second microservice as a query parameter on a redirect Uniform Resource Locator (URL), wherein the second portion is removed from the cookie.

2. The non-transitory computer readable medium of claim 1, wherein the first microservice is a Single Sign On (SSO) microservice and the second microservice is a Security Assertion Markup Language (SAML) microservice.

3. The non-transitory computer readable medium of claim 2, wherein the operation is an authentication function, wherein the second portion of information comprises a result of the authentication function.

4. The non-transitory computer readable medium of claim 3, wherein the result of the authentication function is provided by the query parameter.

5. The non-transitory computer readable medium of claim 1, wherein the format specific to the first microservice cannot be read by other microservices.

6. The non-transitory computer readable medium of claim 1, the providing further comprising a request cookie for authentication requests and a session cookie for microservice states.

7. The non-transitory computer readable medium of claim 6, wherein the request cookie and the session cookie are each encrypted with keys that are changed on a predetermined time period.

8. A system for providing cloud based identity and access management, comprising:

a plurality of tenants;

a plurality of microservices; and

one or more processors that;

at a first microservice, save a current state on a cookie that is stored on a browser, wherein the current state is saved in a format specific to the first microservice;

perform an operation, on the first microservice, that generates a first portion of information and a second portion of information;

store the first portion of information, related to the operation, on the cookie, the first portion comprising the current state; and

provide a second portion of information, related to the operation, to a second microservice as a query parameter on a redirect Uniform Resource Locator (URL), wherein the second portion is removed from the cookie.

9. The system of claim 8, wherein the first microservice is a Single Sign On (SSO) microservice and the second microservice is a Security Assertion Markup Language (SAML) microservice.

10. The system of claim 9, wherein the operation is an authentication function, wherein the second portion of information comprises a result of the authentication function.

11. The system of claim 10, wherein the result of the authentication function is provided by the query parameter.

12. The system of claim 8, wherein the format specific to the first microservice cannot be read by other microservices.

13. The system of claim 8, the processors further generating a request cookie for authentication requests and a session cookie for microservice states.

14. The system of claim 13, wherein the request cookie and the session cookie are each encrypted with keys that are changed on a predetermined time period.

15. A method of providing cloud based identity management, the method comprising:

at a first microservice, saving a current state on a cookie that is stored on a browser, wherein the current state is saved in a format specific to the first microservice;

performing an operation, on the first microservice, that generates a first portion of information and a second portion of information;

storing the first portion of information, related to the operation, on the cookie, the first portion comprising the current state; and

providing a second portion of information, related to the operation, to a second microservice as a query parameter on a redirect Uniform Resource Locator (URL), wherein the second portion is removed from the cookie.

16. The method of claim 15, wherein the first microservice is a Single Sign On (SSO) microservice and the second microservice is a Security Assertion Markup Language (SAML) microservice.

17. The method of claim 16, wherein the operation is an authentication function, wherein the second portion of information comprises a result of the authentication function.

18. The method of claim 17, wherein the result of the authentication function is provided by the query parameter.

19. The method of claim 15, wherein the format specific to the first microservice cannot be read by other microservices.

20. The method of claim 15, further comprising a request cookie for authentication requests and a session cookie for microservice states.