System and method for identity management providers in a cloud platform environment

• US 9,847,905 B2
• Filed: 09/05/2014
• Issued: 12/19/2017
• Est. Priority Date: 10/30/2013
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Perez, Craig, Sapaliga, Bhavanishankara
• Primary Examiner(s): Tran, Tri
• Application Number:
  US14/478,987
• Publication Number:
  US 20150121483A1
• Time in Patent Office: 1,201 Days
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/0895 Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 41/50 Network service management, e.g. ensuring proper service fulfilment according to agreements
• CPC Class Codes: H04L 41/5041 characterised by the time relationship between creation and deployment of a service
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Described herein is a system and method for supporting an identity management provider in a cloud computing environment. In accordance with an embodiment, an identity management (IDM) provider can provide an identity store (e.g., LDAP directory) configuration for use by a cloud platform (e.g., CloudLogic) service. In accordance with an embodiment, the IDM provider can centrally manage one or more identity store configurations, and supply a particular configuration to the orchestration engine when a service is being provisioned, so that the service can then be launched with an appropriate identity store. This allows a platform administrator to specify identity store configurations once and in one place, instead of having to create an identity store configuration for each service.

Claims

1. A system for managing identity store configurations in a platform as a service (PaaS) layer in a cloud environment, comprising:

one or more computers including a cloud environment executing thereon;

a software suite within the cloud environment that supports provisioning PaaS services, and includes a first service definition package (SDP), and a second SDP, wherein each SDP includes a service management engine (SME), and a virtual assembly that defines and configures a set of virtual appliances;

a provider type derived from the first SDP for use in creating a provider service that stores and manages a plurality of identity store configurations, wherein each identity store configuration is associated with a different identity store;

a service type derived from the second SDP for use in creating a PaaS service, wherein the service type specifies one of the plurality of identity store configurations as a dependency;

wherein when the PaaS service is created from the service type and deployed on one or more virtual machines defined and configured by the virtual assembly, the SME in the second SDP operates to

retrieve, from the provider service, the identity store configuration specified by the service type, and

use the retrieved identity store configuration to configure the associated identity store for use by the PaaS service.

2. The system of claim 1, wherein the provider service supports validating credentials of a service administrator that are stored in an identity store to ensure that the PaaS service be managed by an appropriate user after the PaaS service is deployed.

3. The system of claim 1, where each of the plurality of identity store configurations is represented with a provider type entry in a domain configuration file.

4. The system of claim 1, wherein the plurality of identity store configurations include configurations for a plurality of lightweight directory access protocol (LDAP) servers including an Oracle Internet Directory (OID), an Active Directory (AD), and an OpenLDAP server.

5. The system of claim 1, wherein the first SDP includes custom code configured to manage a runtime of the provider service, and the second SDP includes custom code configured to manage a runtime of the PaaS service.

6. The system of claim 1, wherein the software suite within the cloud environment is an installable PaaS platform component.

7. The system of claim 1, wherein the SME in the second SDP implements an association handler object interface, and retrieves the identity store configuration specified by the service type from the provider service using the association result object from the provider service.

8. A method of managing identity store configurations in a platform as a service (PaaS) layer in a cloud environment, comprising:

providing, at one or more computers including a cloud environment executing thereon, a software suite within the cloud environment that supports provisioning PaaS services, and includes a first service definition package (SDP), and a second SDP, wherein each SDP includes a service management engine (SME),and a virtual assembly that defines and configures a set of virtual appliances;

deriving a provider type from the first SDP for use in creating a provider service that stores and manages a plurality of identity store configurations, wherein each identity store configuration is associated with a different identity store;

deriving a service type from the second SDP for use in creating a PaaS service, wherein the service type specifies one of the plurality of identity store configurations as a dependency;

deploying the PaaS service created from the service type on one or more virtual machines defined and configured by the virtual assembly;

retrieving, using the SME in the second SDP, the identity store configuration specified by the service type from the provider service; and

using the retrieved identity store configuration to configure the associated identity store for use by the PaaS service.

9. The method of claim 8, wherein the provider service supports validating credentials of a service administrator that are stored in an identity store to ensure that the PaaS service be managed by an appropriate user after the PaaS service is deployed.

10. The method of claim 8, where each of the plurality of identity store configurations is represented with a provider type entry in a domain configuration file.

11. The method of claim 8, wherein the plurality of identity store configurations include configurations for a plurality of lightweight directory access protocol (LDAP) servers including an Oracle Internet Directory (OID), an Active Directory (AD), and an OpenLDAP server.

12. The method of claim 8, wherein the first SDP includes custom code configured to manage a runtime of the provider service, and the second SDP includes custom code configured to manage a runtime of the PaaS service.

13. The method of claim 8, wherein the software suite within the cloud environment is an installable PaaS platform component.

14. The method of claim 8, wherein the SME in the second SDP implements an association handler object interface, and retrieves the identity store configuration specified by the service type from the provider service using the association result object from the provider service.

15. A non-transitory computer readable storage medium, including instructions stored thereon which when read and executed by one or more computers cause the one or more computers to perform the steps comprising:

providing, at one or more computers including a cloud environment executing thereon, a software suite within the cloud environment that supports provisioning PaaS services, and includes a first service definition package (SDP), and a second SDP, wherein each SDP includes a service management engine (SME),and a virtual assembly that defines and configures a set of virtual appliances;

deriving a provider type from the first SDP for use in creating a provider service that stores and manages a plurality of identity store configurations, wherein each identity store configuration is associated with a different identity store;

deriving a service type from the second SDP for use in creating a PaaS service, wherein the service type specifies one of the plurality of identity store configurations as a dependency;

deploying the PaaS service created from the service type on one or more virtual machines defined and configured by the virtual assembly;

retrieving, using the SME in the second SDP, the identity store configuration specified by the service type from the provider service; and

using the retrieved identity store configuration to configure the associated identity store for use by the PaaS service.

16. The non-transitory computer readable storage medium of claim 15, wherein the provider service supports validating credentials of a service administrator that are stored in an identity store to ensure that the PaaS service be managed by an appropriate user after the PaaS service is deployed.

17. The non-transitory computer readable storage medium of claim 15, where each of the plurality of identity store configurations is represented with a provider type entry in a domain configuration file.

18. The non-transitory computer readable storage medium of claim 15, wherein the plurality of identity store configurations include configurations for a plurality of lightweight directory access protocol (LDAP) servers including an Oracle Internet Directory (OID), an Active Directory (AD), and an OpenLDAP server.

19. The non-transitory computer readable storage medium of claim 15, wherein the first SDP includes custom code configured to manage a runtime of the provider service, and the second SDP includes custom code configured to manage a runtime of the PaaS service.

20. The non-transitory computer readable storage medium of claim 15, wherein the software suite within the cloud environment is an installable PaaS platform component.