Tenant and service management for a multi-tenant identity and data security management cloud service

• US 10,616,224 B2
• Filed: 09/15/2017
• Issued: 04/07/2020
• Est. Priority Date: 09/16/2016
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Subramanian, Elangovan, Neelakanteshwar, Manohari, Purushothaman, Rajesh
• Primary Examiner(s): Pearson, David J
• Assistant Examiner(s): Champakesan, Badri Narayanan
• Application Number:
  US15/705,648
• Publication Number:
  US 20180083967A1
• Time in Patent Office: 935 Days
• Field of Search: 726 4
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 9/5072 Grid computing
• CPC Class Codes: H04L 41/5041 characterised by the time relationship between creation and deployment of a service
• CPC Class Codes: H04L 41/5096 wherein the managed service relates to distributed or central networked applications
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/146 Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding

Abstract

Tenant and service management for an Identity Cloud Service (IDCS) is provided. A request is received, from a Tenant Automation System (TAS) over a network, to create an IDCS service instance for a tenant. The IDCS service instance is created using a task execution framework that includes a task orchestrator and a plurality of synchronous tasks, the task orchestrator instantiating the tasks, controlling the tasks and generating a response to the request. A response, indicating that the IDCS service instance for the tenant has been created, is sent to the TAS over the network.

Claims

1. A non-transitory computer readable medium having instructions stored thereon that, when executed by a processor, cause the processor to provide tenant and service management for an identity cloud, the providing comprising:

receiving, from a Tenant Automation System (TAS) over a network, a request to create an identity cloud service instance for a tenant, wherein the TAS invokes one or more secure identity cloud APIs using privileges of a token associated with an internal identity cloud infra tenancy that comprises a bootstrap tenancy configured to permit access to create identity cloud service instances for tenants;

creating the identity cloud service instance using a task execution framework that includes a task orchestrator and a plurality of synchronous tasks, the task orchestrator instantiating the plurality of synchronous tasks, controlling the plurality of synchronous tasks and generating a response to the request, wherein creating the identity cloud service instance includes creating routing Uniform Resource Locators (URLs) and provisioning namespaces for the tenant; and

sending, to the TAS over the network, the response indicating that the identity cloud service instance for the tenant has been created.

2. The computer readable medium of claim 1, wherein the identity cloud service instance is created without manual intervention by an administrator.

3. The computer readable medium of claim 1, wherein the response includes tenant-specific data.

4. The computer readable medium of claim 1, wherein said creating the identity cloud service instance includes configuring load balancing policies.

5. The computer readable medium of claim 1, wherein the routing URLs include a permanent URL, a friendly URL and a vanity URL.

6. The computer readable medium of claim 2, wherein the identity cloud service instance is created using one of a plurality of a pre-created schema.

7. The computer readable medium of claim 1, further comprising upgrading the identity cloud service instance using the task execution framework, including upgrading artifacts associated with the tenant.

18. The computer readable medium of claim 1, wherein, when invoking an identity cloud API call, the TAS generates a payload that includes a keystore, and the keystore is stored in a tenant schema in a database.

19. The computer readable medium of claim 18, wherein the keystore payload associated with the invoked identity cloud API call implements a secure communication of the keystore.

20. The computer readable medium of claim 1, wherein the received request to create an identity cloud service instance is for an external tenant, the internal infra identity cloud tenancy comprises a bootstrap tenancy configured to permit access to create identity cloud service instances for external tenants, and the created identity cloud service instance is created for the external tenant.

8. A method for providing tenant and service management for an identity cloud, the method comprising:

receiving, from a Tenant Automation System (TAS) over a network, a request to create an identity cloud service instance for a tenant, wherein the TAS invokes one or more secure identity cloud APIs using privileges of a token associated with an internal identity cloud infra tenancy that comprises a bootstrap tenancy configured to permit access to create identity cloud service instances for tenants;

creating the identity cloud service instance using a task execution framework that includes a task orchestrator and a plurality of synchronous tasks, the task orchestrator instantiating the plurality of synchronous tasks, controlling the plurality of synchronous tasks and generating a response to the request, wherein creating the identity cloud service instance includes creating routing Uniform Resource Locators (URLs) and provisioning namespaces for the tenant; and

sending, to the TAS over the network, the response indicating that the identity cloud service instance for the tenant has been created.

9. The method of claim 8, wherein the identity cloud service instance is created without manual intervention by an administrator.

10. The method of claim 8, wherein the response includes tenant-specific data.

11. The method of claim 8, wherein said creating the identity cloud service instance includes configuring load balancing policies, and wherein the routing URLs include a permanent URL, a friendly URL and a vanity URL.

12. The method of claim 9, wherein the identity cloud service instance is created using one of a plurality of a pre-created schema.

13. The method of claim 8, further comprising upgrading the identity cloud service instance using the task execution framework, including upgrading artifacts associated with the tenant.

14. A system for providing tenant and service management for an identity cloud, the system comprising:

a memory; and

a processor, coupled to the memory and a network, the processor being configured to;

receive, from a Tenant Automation System (TAS) over the network, a request to create an identity cloud service instance for a tenant, wherein the TAS invokes one or more secure identity cloud APIs using privileges of a token associated with an internal identity cloud infra tenancy that comprises a bootstrap tenancy configured to permit access to create identity cloud service instances for tenants;

create the identity cloud service instance using a task execution framework that includes a task orchestrator and a plurality of synchronous tasks, the task orchestrator instantiating the plurality of synchronous tasks controlling the plurality of synchronous tasks and generating a response to the request, wherein creating the identity cloud service instance includes creating routing Uniform Resource Locators (URLs) and provisioning namespaces for the tenant; and

send, to the TAS over the network, the response indicating that the identity cloud service instance for the tenant has been created.

15. The system of claim 14, wherein the identity cloud service instance is created without manual intervention by an administrator, and the response includes tenant-specific data.

16. The system of claim 14, wherein said creating the identity cloud service instance includes configuring load balancing policies, and wherein the routing URLs include a permanent URL, a friendly URL and a vanity URL.

17. The system of claim 14, wherein the processor is further configured to upgrade the identity cloud service instance using the task execution framework, including upgrading artifacts associated with the tenant.