Generating derived credentials for a multi-tenant identity cloud service

• US 10,594,684 B2
• Filed: 09/07/2017
• Issued: 03/17/2020
• Est. Priority Date: 09/14/2016
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Bansal, Ajeet, Lander, Vadim, Wilson, Gregg
• Primary Examiner(s): Lewis, Lisa C
• Assistant Examiner(s): Salman, Raied A
• Application Number:
  US15/697,862
• Publication Number:
  US 20180077138A1
• Time in Patent Office: 922 Days
• Field of Search: 726 7, 726 34, 707785
• CPC Class Codes: G06F 2209/5018 Thread allocation
• CPC Class Codes: G06F 9/4843 by program, e.g. task dispatcher, supervisor, operating system
• CPC Class Codes: G06F 9/4881 Scheduling strategies for dispatcher, e.g. round robin, multi-level priority queues
• CPC Class Codes: G06F 9/5027 the resource being a machine, e.g. CPUs, Servers, Terminals
• CPC Class Codes: G06Q 20/325 using wireless networks
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04W 12/08 Access security

Abstract

A multi-tenant system that provides cloud-based identity management receives a request to execute a job, where the job has a scheduled start time, or a timeframe to complete, that exceeds the validity time of a request access token. The system generates the request access token corresponding to the job, where the request access token has access privileges. The system schedules the job and persists the request access token. The system triggers the job at the scheduled start time and generates a derived access token based on the request access token, where the derived access token includes the access privileges. The system then injects the derived access token during runtime of the job and calls a microservice using the derived access token to execute the job.

Claims

1. A non-transitory computer readable medium having instructions stored thereon that, when executed by a processor, cause the processor to provide cloud based identity management, the providing comprising:

receiving, at a current time, a request to execute a job, the job requiring a corresponding access token to be executed, the access token comprising an expiration time, wherein the job has a scheduled start time later than the current time plus the expiration time;

generating, before the scheduled start time, a first access token corresponding to the job, the first access token comprising access privileges;

before the scheduled start time, scheduling the job to be executed at the scheduled start time using the first access token;

persisting the first access token before the scheduled start time;

triggering the job at the scheduled start time;

in response to the triggering, generating a second access token that is derived from the first access token, wherein the second access token comprises the same access privileges as the first access token;

injecting the second access token during runtime of the job; and

using the second access token to execute the job after an expiration of the first access token.

2. The non-transitory computer readable medium of claim 1, wherein the second access token comprises an expiration time that exceeds a timeframe to complete the job.

3. The non-transitory computer readable medium of claim 1, further comprising signing the second access token using current signing keys.

4. The non-transitory computer readable medium of claim 1, wherein executing the job comprises calling a microservice comprising invoking an application programming interface that corresponds to the microservice.

5. The non-transitory computer readable medium of claim 1, wherein the first access token is persisted with metadata corresponding to the job.

6. The non-transitory computer readable medium of claim 5, wherein the first access token is retrieved from the metadata and decoded.

7. The non-transitory computer readable medium of claim 1, wherein the request comprises an identity of a tenant of a plurality of tenants that comprises a resource needed to execute the job.

8. A method to provide cloud based identity management, the method comprising:

receiving, at a current time, a request to execute a job, the job requiring a corresponding access token to be executed, the access token comprising an expiration time, wherein the job has a scheduled start time later than the current time plus the expiration time,;

generating, before the scheduled start time, a first access token corresponding to the job, the first access token comprising access privileges;

before the scheduled start time, scheduling the job to be executed at the scheduled start time using the first access token;

persisting the first access token before the scheduled start time;

triggering the job at the scheduled start time;

in response to the triggering, generating a second access token that is derived from the first access token, wherein the second access token comprises the same access privileges as the first access token;

injecting the second access token during runtime of the job; and

using the second access token to execute the job after an expiration of the first access token.

9. The method of claim 8, wherein the second access token comprises an expiration time that exceeds a timeframe to complete the job.

10. The method of claim 8, further comprising signing the second access token using current signing keys.

11. The method of claim 8, executing the job comprises calling a microservice comprising invoking an application programming interface that corresponds to the microservice.

12. The method of claim 8, wherein the first access token is persisted with metadata corresponding to the job.

13. The method of claim 12, wherein the first access token is retrieved from the metadata and decoded.

14. The method of claim 8, wherein the request comprises an identity of a tenant of a plurality of tenants that comprises a resource needed to execute the job.

15. A system for providing cloud-based identity and access management, comprising:

a plurality of tenants;

a plurality of microservices; and

one or more hardware processors that execute instructions to;

receive, at a current time, a request to execute a job, the job requiring a corresponding access token to be executed, the access token comprising an expiration time, wherein the job has a scheduled start time later than the current time plus the expiration time,;

generate, before the scheduled start time, a first access token corresponding to the job, the first access token comprising access privileges;

before the scheduled start time, schedule the job to be executed at the scheduled start time using the first access token;

persist the first access token before the scheduled start time;

trigger the job at the scheduled start time;

in response to the trigger, generate a second access token that is derived from the first access token, wherein the second access token comprises the same access privileges as the first access token;

inject the second access token during runtime of the job; and

use the second access token to execute the job after an expiration of the first access token.

16. The system of claim 15, wherein the second access token comprises an expiration time that exceeds a timeframe to complete the job.

17. The system of claim 15, further comprising signing the second access token using current signing keys.

18. The system of claim 15, wherein executing the job comprises calling a microservice comprising invoking an application programming interface that corresponds to the microservice.

19. The system of claim 15, wherein the first access token is persisted with metadata corresponding to the job.

20. The system of claim 19, wherein the first access token is retrieved from the metadata and decoded.