Data management for a multi-tenant identity cloud service

• US 10,484,382 B2
• Filed: 08/18/2017
• Issued: 11/19/2019
• Est. Priority Date: 08/31/2016
• Status: Active Grant

• Current Assignee: Oracle Corporation, Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Wilson, Gregg, Medam, Venkateswara Reddy
• Primary Examiner(s): Mehedi, Morshed
• Application Number:
  US15/680,362
• Publication Number:
  US 20180063143A1
• Time in Patent Office: 823 Days
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/60 Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources admission control or resource allocation H04L47/70

Abstract

Cloud based identity management is provided by receiving a request from an application by a web gate for a resource, where the request includes an operation on a resource type out of a plurality of resource types and the request specifies a tenant out of a plurality of tenants. Embodiments access a microservice based on the request, resolve the resource type, and validate that the operation is supported by the resource type based on metadata. Embodiments get a data provider associated with the tenant, call the data provider to perform the operation, and then return the resource.

Claims

1. A non-transitory computer readable medium having instructions stored thereon that, when executed by a processor, cause the processor to provide cloud based identity management, the providing comprising:

receiving a request from an application by a web gate for a resource, wherein the request comprises an operation on a resource type out of a plurality of resource types and the request specifies a tenant out of a plurality of tenants, the resource type comprising a schema definition, and the schema definition comprises a plurality of attributes and metadata for each of the attributes, the resource type comprising one of a user or a second application;

accessing a microservice based on the request;

resolving the resource type comprising determining the resource type and retrieving corresponding schema and schema definitions;

validating that the operation is supported by the resource type based on the metadata;

getting a data provider associated with the tenant;

calling the data provider to perform the operation; and

returning the resource.

2. The non-transitory computer readable medium of claim 1, wherein the metadata comprises a JavaScript Object Notation (JSON).

3. The non-transitory computer readable medium of claim 1, wherein the validating comprises checking for valid attribute names, valid data types and missing required attributes.

4. The non-transitory computer readable medium of claim 1, the resolving further comprising determining which attributes are required for the resource type based on the schema in order to perform the validating.

5. The non-transitory computer readable medium of claim 1, wherein for multiple versions of the resource type, at least one version of the resource type comprises a tag indicating a deprecated attribute with respect to a previous version, and at least one version of the resource type comprises a tag indicating an added attribute with respect to a previous resource type, further comprising:

performing the operation using the version of the resource type based on corresponding tags of the resource type.

6. The non-transitory computer readable medium of claim 1, wherein the operation comprises one of create, update, delete, get or search.

7. The non-transitory computer readable medium of claim 1, wherein the resource type is a user, and the corresponding schema comprises a password state.

8. The non-transitory computer readable medium of claim 1, wherein the data provider comprises one of a database or an Lightweight Directory Access Protocol (LDAP) provider.

9. A method of providing cloud based identity management, the method comprising:

receiving a request from an application by a web gate for a resource, wherein the request comprises an operation on a resource type out of a plurality of resource types and the request specifies a tenant out of a plurality of tenants, the resource type comprising a schema definition, and the schema definition comprises a plurality of attributes and metadata for each of the attributes, the resource type comprising one of a user or a second;

accessing a microservice based on the request;

resolving the resource type comprising determining the resource type and retrieving corresponding schema and schema definitions;

validating that the operation is supported by the resource type based on the metadata;

getting a data provider associated with the tenant;

calling the data provider to perform the operation; and

returning the resource.

10. The method of claim 9, wherein the metadata comprises a JavaScript Object Notation (JSON).

11. The method of claim 9, wherein the validating comprises checking for valid attribute names, valid data types and missing required attributes.

12. The method of claim 9, the resolving further comprising determining which attributes are required for the resource type based on the schema in order to perform the validating.

13. The method of claim 9, wherein for multiple versions of the resource type, at least one version of the resource type comprises a tag indicating a deprecated attribute with respect to a previous version, and at least one version of the resource type comprises a tag indicating an added attribute with respect to a previous resource type, further comprising:

performing the operation using the version of the resource type based on corresponding tags of the resource type.

14. The method of claim 9, wherein the operation comprises one of create, update, delete, get or search.

15. The method of claim 9, wherein the resource type is a user, and the corresponding schema comprises a password state.

16. The method of claim 9, wherein the data provider comprises one of a database or an Lightweight Directory Access Protocol (LDAP) provider.

17. A system for providing cloud based identity and access management, comprising:

a plurality of tenants;

a plurality of microservices; and

one or more hardware processors that execute instructions to;

receive a request from an application by a web gate for a resource, wherein the request comprises an operation on a resource type out of a plurality of resource types and the request specifies a tenant out of the plurality of tenants, the resource type comprising a schema definition, and the schema definition comprises a plurality of attributes and metadata for each of the attributes, the resource type comprising one of a user or a second application;

access a microservice out of the plurality of microservices based on the request;

resolve the resource type comprising determining the resource type and retrieving corresponding schema and schema definitions;

validate that the operation is supported by the resource type based on the metadata;

get a data provider associated with the tenant;

call the data provider to perform the operation; and

return the resource.

18. The system of claim 17, wherein the metadata comprises a JavaScript Object Notation (JSON).

19. The system of claim 17, wherein the validating comprises checking for valid attribute names, valid data types and missing required attributes.

20. The system of claim 17, the resolve further comprising determining which attributes are required for the resource type based on the schema in order to perform the validate.