Tenant self-service troubleshooting for a multi-tenant identity and data security management cloud service

• US 10,585,682 B2
• Filed: 07/12/2017
• Issued: 03/10/2020
• Est. Priority Date: 08/05/2016
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Jain, Vikrant, Gupta, Ashish, Cole, Gary P., Lander, Vadim
• Primary Examiner(s): Leggett, Andrea C
• Application Number:
  US15/647,804
• Publication Number:
  US 20180039501A1
• Time in Patent Office: 972 Days
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0769 Readable error formats, e.g. cross-platform generic formats, human understandable formats
• CPC Class Codes: G06F 11/0787 Storage of error reports, e.g. persistent data storage, storage using memory protection
• CPC Class Codes: G06F 9/451 Execution arrangements for user interfaces
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A system provides cloud-based identity and access management. The system provides a user interface (“UI”) to a tenant of an identity-management service. The system enables diagnostics functionality for the tenant based on a user input received via the UI, where the diagnostics functionality allows for a user in the tenant to configure and receive diagnostics reports related to the identity-management service. The system then receives a request for the identity-management service, accesses a microservice based on the request, performs the identity-management service by the microservice, collects and records diagnostics information during the performing of the identity-management service, and displays the diagnostics information to the user via the UI.

Claims

1. A non-transitory computer readable medium having instructions stored thereon that, when executed by at least one processor, cause the processor to provide a cloud-based multi-tenant identity and access management system, the providing comprising:

providing a user interface (UI) to a user corresponding to a first tenant of a plurality of tenants of the multi-tenant identity and access management system;

enabling diagnostics functionality for the first tenant based on a user input received via the UI, wherein the diagnostics functionality allows for the user to configure and receive diagnostics reports related to an identity-management service performed by the multi-tenant identity and access management system for the user, wherein the identity-management service comprises authenticating the user;

receiving a request for the identity-management service from the user;

accessing a microservice based on the request;

performing the identity-management service by the microservice;

collecting and recording diagnostics information during the performing of the identity-management service, the diagnostics information comprising problems associated with the identity-management service that are specific to the first tenant; and

displaying the diagnostics information to the user via the UI.

2. The computer readable medium of claim 1, wherein the diagnostics information does not include diagnostics information related to any identity-management services for other tenants of the plurality of tenants performed by the multi-tenant identity and access management system.

3. The computer readable medium of claim 1, the providing further comprising disabling the diagnostics functionality for the first tenant based on another user input received via the UI.

4. The computer readable medium of claim 1, wherein the microservice is stateless, wherein the microservice performs the identity-management service using data stored in a remote cache, wherein the remote cache comprises a distributed data grid, wherein the remote cache and the microservice are configured to scale independently of one another.

5. The computer readable medium of claim 4, wherein the remote cache implements a different namespace for each tenant that uses the microservice.

6. The computer readable medium of claim 1, wherein the diagnostics functionality is implemented by a diagnostics client and a diagnostics server, wherein the diagnostics client is invoked by the microservice, wherein the diagnostics server runs on an administration microservice.

7. The computer readable medium of claim 6, wherein communication between the diagnostics client and the diagnostics server is performed over Representational State Transfer (REST) protocol using an authentication token with administrative level privileges.

8. The computer readable medium of claim 6, wherein the diagnostics client collects the diagnostics information and pushes it to the diagnostics server, wherein the diagnostics server saves the diagnostics information in a storage.

9. The computer readable medium of claim 8, wherein, upon determining that the user wants to access the diagnostics information, the UI makes a corresponding call to the diagnostics service, wherein the diagnostics service performs a search on the stored diagnostics information and provides the required information to the UI.

10. The computer readable medium of claim 1, wherein each entry in the diagnostics information includes a timestamp and an execution-context identifier ECID, and a relationship identifier RID, wherein each entry in the diagnostics information further includes an actor name if applicable.

11. The computer readable medium of claim 10, wherein a traffic director generates the ECID for the request, wherein the ECID uniquely identifies the request.

12. The computer readable medium of claim 10, wherein the request forms a root of a tree of sub-tasks that need to be completed for the request, wherein the RID comprises an ordered set of numbers that describes a location of a task in the tree of sub-tasks, wherein the diagnostics information relates to the sub-task.

13. A method of operating a cloud-based multi-tenant identity and access management system, comprising:

providing a user interface (UI) to a user corresponding to a first tenant of a plurality of tenants of the multi-tenant identity and access management system;

enabling diagnostics functionality for the first tenant based on a user input received via the UI, wherein the diagnostics functionality allows for the user to configure and receive diagnostics reports related to an identity-management service performed by the multi-tenant identity and access management system for the user, wherein the identity-management service comprises authenticating the user;

receiving a request for the identity-management service from the user;

accessing a microservice based on the request;

performing the identity-management service by the microservice;

collecting and recording diagnostics information during the performing of the identity-management service, the diagnostics information comprising problems associated with the identity-management service that are specific to the first tenant; and

displaying the diagnostics information to the user via the UI.

14. The method of claim 13, wherein the diagnostics information does not include diagnostics information related to any identity-management services for other tenants of the plurality of tenants performed by the multi-tenant identity and access management system.

15. The method of claim 13, the providing further comprising disabling the diagnostics functionality for the first tenant based on another user input received via the UI.

16. The method of claim 13, wherein the microservice is stateless, wherein the microservice performs the identity-management service using data stored in a remote cache, wherein the remote cache comprises a distributed data grid, wherein the remote cache and the microservice are configured to scale independently of one another.

17. The method of claim 16, wherein the remote cache implements a different namespace for each tenant that uses the microservice.

18. The method of claim 13, wherein the diagnostics functionality is implemented by a diagnostics client and a diagnostics server, wherein the diagnostics client is invoked by the microservice, wherein the diagnostics server runs on an administration microservice.

19. The method of claim 18, wherein communication between the diagnostics client and the diagnostics server is performed over Representational State Transfer (REST) protocol using an authentication token with administrative level privileges.

20. A cloud-based multi-tenant identity and access management system for cloud-based identity and access management, comprising:

a providing module that provides a user interface (UI) to a user corresponding to a first tenant of a plurality of tenants of the multi-tenant identity and access management system;

an enabling module that enables diagnostics functionality for the first tenant based on a user input received via the UI, wherein the diagnostics functionality allows for the user to configure and receive diagnostics reports related to an identity-management service performed by the multi-tenant identity and access management system for the user, wherein the identity-management service comprises authenticating the user;

a receiving module that receives a request for the identity-management service;

an accessing module that accesses a microservice based on the request;

a performing module that performs the identity-management service by the microservice;

a collecting and recording module that collects and records diagnostics information during the performing of the identity-management service, the diagnostics information comprising problems associated with the identity-management service that are specific to the first tenant; and

a displaying module that displays the diagnostics information to the user via the UI.