Single logout functionality for a multi-tenant identity and data security management cloud service

• US 10,511,589 B2
• Filed: 09/14/2017
• Issued: 12/17/2019
• Est. Priority Date: 09/14/2016
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Gangawane, Jay Vijay, Joseph, Binoy, Sankesara, Bhavik, Uchil, Mrudul Pradeep
• Primary Examiner(s): Pwu, Jeffrey C
• Assistant Examiner(s): Ambaye, Samuel
• Application Number:
  US15/704,544
• Publication Number:
  US 20180077144A1
• Time in Patent Office: 824 Days
• Field of Search: 726 8
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

A cloud-based identity and access management system that implements single sign-on (“SSO”) receives a first request for an identity management service configured to allow for accessing applications. Embodiments send the first request to a first microservice, where the first microservice performs the identity management service by generating a token. The first microservice generates the token at least in part by sending a second request to a SSO. The SSO microservice implements an SSO and generates a cookie that includes a global state and is used for communicating with different microservices. Embodiments receive a single log-out (SLO) of the SSO and use the cookie to iteratively log-out of the applications, where, after each log-out of an application of a first protocol, a redirect is performed to the SSO microservice to trigger log-out of applications of a different protocol.

Claims

1. A non-transitory computer readable medium having instructions stored thereon that, when executed by a processor, cause the processor to provide cloud-based identity and access management, the providing comprising:

receiving a first request for an identity management service configured to allow for accessing at least two applications comprising a first application that requires a first access protocol and a second application that requires a second access protocol that is different than the first access protocol;

sending the first request to a first microservice, wherein the first microservice performs the identity management service by generating a token, wherein the first microservice generates the token at least in part by sending a second request to a single sign-on (SSO) microservice, wherein the SSO microservice is configured to provide SSO functionality across different microservices that are based on different access protocols;

wherein the SSO microservice implements an SSO and generates a cookie that includes a global state and is used for communicating with different microservices;

receiving a single log-out (SLO) of the SSO; and

using the cookie to iteratively log-out of the applications, wherein, after each logout of an application of the first access protocol, a redirect is performed to the SSO microservice to trigger log-out of applications of a different protocol, wherein the iterative log-out of the applications comprises triggering a log-out of the first application, receiving the redirect and determining that there is another access protocol for log-out that is different from the first access protocol, and triggering a log-out of the second application;

wherein the cookie indicates applications that are signed into the SSO and the redirect is stored on the cookie.

2. The computer readable medium of claim 1, further comprising:

receiving the token from the first microservice; and

providing the token to an application, wherein the token allows for accessing the application.

3. The computer readable medium of claim 1, wherein the first microservice is configured to provide an authentication functionality based on the first access protocol.

4. The computer readable medium of claim 3, wherein the first access protocol is OAuth or Security Assertion Markup Language (SAML), wherein the SSO microservice is configured to provide SSO functionality across both OAuth and SAML.

5. The computer readable medium of claim 4, wherein the SSO microservice generates a global session configured as a session cookie and provides the global session to the first microservice.

6. The computer readable medium of claim 5, wherein the first microservice converts the global session into the token.

18. The computer readable medium of claim 1, further comprising triggering a log-out of a first endpoint corresponding to the first access protocol and a second endpoint corresponding to the second access protocol.

7. A method of providing cloud-based identity and access management comprising:

receiving a first request for an identity management service configured to allow for accessing at least two applications comprising a first application that requires a first access protocol and a second application that requires a second access protocol that is different than the first access protocol;

sending the first request to a first microservice, wherein the first microservice performs the identity management service by generating a token, wherein the first microservice generates the token at least in part by sending a second request to a single sign-on (SSO) microservice, wherein the SSO microservice is configured to provide SSO functionality across different microservices that are based on different access protocols;

wherein the SSO microservice implements an SSO and generates a cookie that includes a global state and is used for communicating with different microservices;

receiving a single log-out (SLO) of the SSO; and

using the cookie to iteratively log-out of the applications, wherein, after each logout of an application of the first access protocol, a redirect is performed to the SSO microservice to trigger log-out of applications of a different protocol, wherein the iterative log-out of the applications comprises triggering a log-out of the first application, receiving the redirect and determining that there is another access protocol for log-out that is different from the first access protocol, and triggering a log-out of the second application;

wherein the cookie indicates applications that are signed into the SSO and the redirect is stored on the cookie.

8. The method of claim 7, further comprising:

receiving the token from the first microservice; and

providing the token to an application, wherein the token allows for accessing the application.

9. The method of claim 7, wherein the first microservice is configured to provide an authentication functionality based on the first access protocol.

10. The method of claim 9, wherein the first access protocol is OAuth or Security Assertion Markup Language (SAML), wherein the SSO microservice is configured to provide SSO functionality across both OAuth and SAML.

11. The method of claim 10, wherein the SSO microservice generates a global session configured as a session cookie and provides the global session to the first microservice.

12. The method of claim 11, wherein the first microservice converts the global session into the token.

19. The method of claim 7, further comprising triggering a log-out of a first endpoint corresponding to the first access protocol and a second endpoint corresponding to the second access protocol.

13. A system for providing cloud based identity and access management, comprising:

a plurality of tenants;

a plurality of microservices; and

one or more processors that;

receive a first request for an identity management service configured to allow for accessing at least two applications comprising a first application that requires a first access protocol and a second application that requires a second access protocol that is different than the first access protocol;

send the first request to a first microservice, wherein the first microservice performs the identity management service by generating a token, wherein the first microservice generates the token at least in part by sending a second request to a single sign-on (SSO) microservice, wherein the SSO microservice is configured to provide SSO functionality across different microservices that are based on different access protocols;

wherein the SSO microservice implements an SSO and generates a cookie that includes a global state and is used for communicating with different microservices;

receive a single log-out (SLO) of the SSO; and

use the cookie to iteratively log-out of the applications, wherein, after each log-out of an application of the first access protocol, a redirect is performed to the SSO microservice to trigger log-out of applications of a different protocol, wherein the iterative log-out of the applications comprises triggering a log-out of the first application, receiving the redirect and determining that there is another access protocol for log-out that is different from the first access protocol, and triggering a log-out of the second application;

wherein the cookie indicates applications that are signed into the SSO and the redirect is stored on the cookie.

14. The system of claim 13, further comprising:

receiving the token from the first microservice; and

providing the token to an application, wherein the token allows for accessing the application.

15. The system of claim 13, wherein the first microservice is configured to provide an authentication functionality based on the first access protocol.

16. The system of claim 15, wherein the first access protocol is OAuth or Security Assertion Markup Language (SAML), wherein the SSO microservice is configured to provide SSO functionality across both OAuth and SAML.

17. The system of claim 16, wherein the SSO microservice generates a global session configured as a session cookie and provides the global session to the first microservice.

20. The system of claim 13, further comprising triggering a log-out of a first endpoint corresponding to the first access protocol and a second endpoint corresponding to the second access protocol.