Reference attribute query processing for a multi-tenant cloud service

• US 10,831,789 B2
• Filed: 05/29/2018
• Issued: 11/10/2020
• Est. Priority Date: 09/27/2017
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Srinivasan, Sudhir Kumar, Chikkanna, Shruthi, Vaishnavi, Nikhil Yograj, Xu, Xiaoxiao, Wilson, Gregg, Medam, Venkateswara R.
• Primary Examiner(s): Hoang, Son T
• Application Number:
  US15/991,083
• Publication Number:
  US 20190095498A1
• Time in Patent Office: 896 Days
• Field of Search: None
• CPC Class Codes: G06F 16/211 Schema design and management
• CPC Class Codes: G06F 16/213 with details for schema evolution support
• CPC Class Codes: G06F 16/2457 with adaptation to user needs
• CPC Class Codes: G06F 16/288 Entity relationship models
• CPC Class Codes: G06F 9/505 considering the load
• CPC Class Codes: G06F 9/5072 Grid computing
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

A system performs reference attribute query processing in a multi-tenant cloud-based identity and access management (IAM) system by: receiving a request from a client of the multi-tenant cloud-based IAM system, where the request indicates one or more reference attributes associated with a resource that is persisted in a database of the multi-tenant cloud-based IAM system, and the request indicates one or more filter conditions configured to be applied on the one or more reference attributes; building a query based on the one or more reference attributes and the one or more filter conditions; retrieving resource data by executing the query on a database of the multi-tenant cloud-based IAM system, where the retrieved resource data is associated with the one or more reference attributes and satisfies the one or more filter conditions; and returning the retrieved data to the client of the multi-tenant cloud-based IAM system.

Claims

1. A method for reference attribute query processing in a multi-tenant cloud-based identity and access management (IAM) system, the method comprising:

receiving a request from a client of the multi-tenant cloud-based IAM system, wherein the request indicates one or more reference attributes associated with an object that is persisted in a database of the multi-tenant cloud-based IAM system, wherein the request indicates one or more filter conditions configured to be applied on the one or more reference attributes and the one or more reference attributes associated with the object are references to other objects in the database, each object comprises a JavaScript Object Notation (JSON) object corresponding to a System for Cross-domain Identity Management (SCIM) resource;

building and generating a query based on the received one or more reference attributes and the received one or more filter conditions;

retrieving object data by executing the query on the database of the multi-tenant cloud-based IAM system, wherein the retrieved object data is associated with the one or more reference attributes and satisfies the one or more filter conditions and data is queried from the referenced objects and then merged into the retrieved object data; and

returning the retrieved object data to the client of the multi-tenant cloud-based IAM system.

2. The method of claim 1, wherein the query is a structured query language (SQL) query executed at run-timer and the database is a relational database management system (“

RDBMS”

) in a backend of the multi-tenant cloud-based IAM system.

3. The method of claim 2, wherein the database comprises a distributed data grid.

4. The method of claim 1, wherein the object is stored in the database of the multi-tenant cloud-based IAM system using a schema configured for storing related objects, wherein the one or more reference attributes are indicative of relationships between the related objects in the database, wherein the schema defines a relationship type and a persistence scope for each reference attribute.

5. The method of claim 4, wherein the retrieving of the object data is performed using an in-memory representation of the related objects and their relationships, wherein the in-memory representation is constructed based on the schema, wherein the in-memory representation indicates the relationship type and the persistence scope for each reference attribute.

6. The method of claim 5, wherein the relationship type indicates whether a corresponding reference attribute is indicative of a direct relationship, an indirect relationship, or a self-nested relationship, wherein the persistence scope indicates whether a corresponding reference attribute is persisted or non-persisted.

7. The method of claim 6, wherein the direct relationship indicates that corresponding referrer and referred objects are directly related.

8. The method of claim 6, wherein the indirect relationship indicates that corresponding referrer and referred objects are connected through at least one other object.

9. The method of claim 6, wherein the self-nested relationship indicates that corresponding referrer and referred objects are the same object.

10. The method of claim 6, wherein a persisted reference attribute indicates that a corresponding referrer object houses a reference to a corresponding referred object and the reference is persisted in a database record of the corresponding referrer object.

11. The method of claim 6, wherein a non-persisted reference attribute indicates that a reference from a corresponding referrer object to a corresponding referred object is not persisted in a database record of the corresponding referrer object.

12. The method of claim 6, wherein the retrieving of the object data comprises:

constructing a first set of reference attributes and a second set of reference attributes, wherein the first set of reference attributes is a first subset of the one or more reference attributes that are indicated as persisted, wherein the second set of reference attributes is a second subset of the one or more reference attributes that are indicated as non-persisted; and

processing the first set and the second set separately to retrieve the object data.

13. The method of claim 12, wherein the first set of reference attributes is processed under an applicable one of simple, complex, or logical filter conditions.

14. The method of claim 12, wherein the second set of reference attributes is divided into further subsets of reference attributes corresponding to relationship types of direct, indirect, self-nested, and non-self-nested, wherein a respective query is built to separately fetch values of attributes associated with each of the further subsets under an applicable one of simple, complex, or logical filter conditions.

15. The method of claim 5, wherein the in-memory representation of the related objects and their relationships is constructed during server start-up.

16. The method of claim 15, wherein a two-pass loading mechanism is implemented during the server start-up, comprising:

in a first pass, building in-memory objects that represent the related objects; and

in a second pass, linking the in-memory objects based on their relationships.

17. The method of claim 1, wherein the request is received from an application that implements IAM functionality provided by components of the multi-tenant cloud-based IAM system, wherein the components comprise one or more microservices.

18. A non-transitory computer-readable medium having instructions stored thereon that, when executed by one or more processors, cause the processors to perform reference attribute query processing in a multi-tenant cloud-based identity and access management (IAM) system, the performing comprising:

receiving a request from a client of the multi-tenant cloud-based IAM system, wherein the request indicates one or more reference attributes associated with an object that is persisted in a database of the multi-tenant cloud-based IAM system, wherein the request indicates one or more filter conditions configured to be applied on the one or more reference attributes and the one or more reference attributes associated with the object are references to other objects in the database, each object comprises a JavaScript Object Notation (JSON) object corresponding to a System for Cross-domain Identity Management (SCIM) resource;

building and generating a query based on the received one or more reference attributes and the received one or more filter conditions;

retrieving object data by executing the query on the database of the multi-tenant cloud-based IAM system, wherein the retrieved object data is associated with the one or more reference attributes and satisfies the one or more filter conditions and data is queried from the referenced objects and then merged into the retrieved object data; and

returning the retrieved object data to the client of the multi-tenant cloud-based IAM system.

19. A system comprising:

one or more processors; and

a computer-readable medium having instructions stored thereon that, when executed by the one or more processors, cause the one or more processors to perform reference attribute query processing in a multi-tenant cloud-based identity and access management (IAM) system, the performing comprising;

receiving a request from a client of the multi-tenant cloud-based IAM system, wherein the request indicates one or more reference attributes associated with an object that is persisted in a database of the multi-tenant cloud-based IAM system, wherein the request indicates one or more filter conditions configured to be applied on the one or more reference attributes and the one or more reference attributes associated with the object are references to other objects in the database, each object comprises a JavaScript Object Notation (JSON) object corresponding to a System for Cross-domain Identity Management (SCIM) resource;

building and generating a query based on the received one or more reference attributes and the received one or more filter conditions;

retrieving object data by executing the query on the database of the multi-tenant cloud-based IAM system, wherein the retrieved object data is associated with the one or more reference attributes and satisfies the one or more filter conditions and data is queried from the referenced objects and then merged into the retrieved object data; and

returning the retrieved object data to the client of the multi-tenant cloud-based IAM system.

20. The system of claim 19, wherein the object is stored in the database of the multi-tenant cloud-based IAM system using a schema configured for storing related objects, the one or more reference attributes are indicative of relationships between the related objects in the database, the schema defines a relationship type and a persistence scope for each reference attribute;

wherein the retrieving of the object data is performed using an in-memory representation of the related objects and their relationships, wherein the in-memory representation is constructed based on the schema, wherein the in-memory representation indicates the relationship type and the persistence scope for each reference attribute;

wherein the relationship type indicates whether a corresponding reference attribute is indicative of a direct relationship, an indirect relationship, or a self-nested relationship, wherein the persistence scope indicates whether a corresponding reference attribute is persisted or non-persisted.