SERVICE DISCOVERY FOR A MULTI-TENANT IDENTITY AND DATA SECURITY MANAGEMENT CLOUD SERVICE

• US 20180041515A1
• Filed: 05/31/2017
• Published: 02/08/2018
• Est. Priority Date: 08/05/2016
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: GUPTA, Lokesh, LANDER, Vadim
• Granted Patent: US 10,516,672 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system provides cloud-based identity and access management. The system receives a request for an identity management service, authenticates the request, and forwards the request to a microservice configured to perform the identity management service, where the microservice is implemented by a microservice virtual machine provisioned by a provisioning framework, and the forwarding is according to routing information configured based on metadata information stored in a registry by the provisioning framework. The system then performs the identity management service by the microservice.

Claims

1. A non-transitory computer readable medium having instructions stored thereon that, when executed by a processor, cause the processor to provide cloud-based identity and access management, the providing comprising:

receiving a request for an identity management service;

authenticating the request;

forwarding the request to a microservice configured to perform the identity management service, wherein the microservice is implemented by a microservice virtual machine provisioned by a provisioning framework, wherein the forwarding is according to routing information configured based on metadata information stored in a registry by the provisioning framework; and

performing the identity management service by the microservice.

2. The computer readable medium of claim 1, wherein the metadata information identifies the microservice virtual machine.

3. The computer readable medium of claim 1, wherein the metadata information comprises an internet protocol (IP) address of the microservice virtual machine.

4. The computer readable medium of claim 1, wherein a service discovery agent (SDA) is implemented as a common code kernel on each virtual machine provisioned by the provisioning framework to implement a service node, a cache node, or a routing node, wherein the provisioning framework stores respective metadata information in the registry for each implemented virtual machine.

5. The computer readable medium of claim 4, wherein the metadata information stored in the registry for the microservice virtual machine is used by each SDA on each routing node in a routing tier to determine the routing information for routing the request.

6. The computer readable medium of claim 5, wherein a resource related to the identity management task is cached in a remote cache, wherein the provisioning framework provisions cache virtual machines that each implement a cache node in a cache cluster that implements the remote cache, wherein the provisioning framework stores in the registry metadata information for each of the cache virtual machines.

7. The computer readable medium of claim 6, wherein the metadata information stored for each of the cache virtual machines is used by each SDA at each cache node to form the cache cluster.

8. The computer readable medium of claim 6, wherein the metadata information stored for each of the cache virtual machines is used by an SDA at the microservice to reach the remote cache.

9. The computer readable medium of claim 6, wherein the microservice is stateless, wherein the remote cache comprises a distributed data grid, wherein the remote cache and the microservice are configured to scale independently of one another.

10. The computer readable medium of claim 6, wherein the remote cache implements a different namespace for each tenant that uses the identity management service.

11. The computer readable medium of claim 1, wherein the microservice virtual machine implements the microservice as an instance of the identity management service.

12. The computer readable medium of claim 1, wherein the metadata stored in the registry is updated upon a status change of the microservice or the microservice virtual machine.

13. The computer readable medium of claim 12, wherein the status change comprises a node provisioning, a node de-provisioning, a node crash, a node hang, a service crash, a service hang, a service time-out, or a topology change.

14. The computer readable medium of claim 1, wherein the status change is determined based on status information available through a health check endpoint implemented by the microservice virtual machine.

15. A method of providing cloud-based identity and access management, comprising:

receiving a request for an identity management service;

authenticating the request;

forwarding the request to a microservice configured to perform the identity management service, wherein the microservice is implemented by a microservice virtual machine provisioned by a provisioning framework, wherein the forwarding is according to routing information configured based on metadata information stored in a registry by the provisioning framework; and

performing the identity management service by the microservice.

16. The method of claim 15, wherein the metadata information identifies the microservice virtual machine.

17. The method of claim 15, wherein the metadata information comprises an internet protocol (IP) address of the microservice virtual machine.

18. The method of claim 15, wherein a service discovery agent (SDA) is implemented as a common code kernel on each virtual machine provisioned by the provisioning framework to implement a service node, a cache node, or a routing node, wherein the provisioning framework stores respective metadata information in the registry for each implemented virtual machine.

19. The method of claim 18, wherein the metadata information stored in the registry for the microservice virtual machine is used by each SDA on each routing node in a routing tier to determine the routing information for routing the request.

20. A system for providing cloud-based identity and access management, comprising:

a receiving module that receives a request for an identity management service;

an authenticating module that authenticates the request;

a forwarding module that forwards the request to a microservice configured to perform the identity management service, wherein the microservice is implemented by a microservice virtual machine provisioned by a provisioning framework, wherein the forwarding is according to routing information configured based on metadata information stored in a registry by the provisioning framework; and

a performing module that performs the identity management service by the microservice.