US 10,097,589 B2 · System and method for supporting security in a multitenant application server environment

Abstract

In accordance with an embodiment, described herein is a system and method for providing security in a multitenant application server environment. In accordance with an embodiment, per-partition security configuration includes: per-partition security realm (including configuration for authentication, authorization, credential mapping, auditing, password validation, certificate validation, and user lockout); SSL configuration, including keys, certificates, and other configuration attributes; and access control for partition and global resources. An administrator can designate one or more partition users as partition administrators, via grant of roles.

Drawings

Drawings are temporarily unavailable. Open the PDF at USPTO

Drawings

Claims20

Dependent claims

A method for providing security in a multitenant application server environment comprising a plurality of partitions, a plurality of partition resources and a plurality of global resources, the method comprising:

providing, during runtime of the multitenant application server environment, a domain object that provides a domain configuration for the multitenant application server environment;
providing, as a child of the domain object, a security configuration object, wherein domain-wide services are configured on the security configuration object, and wherein the security configuration object includes a parent container for a plurality of realm objects;
providing a plurality of security realm objects including an admin security realm object, a first security realm object, and a second security realm object, wherein the first and second security realm objects are included in the parent container, and wherein each security realm object defines a configuration of security services;
configuring a first partition of the plurality of partitions to have a first plurality of partition resources of the plurality of partition resources;
configuring a second partition of the plurality of partitions to have a second plurality of partition resources of the plurality of partition resources;
providing a first partition security configuration including a realm attribute, wherein the value of the realm attribute of the first partition security configuration associates the first partition with the first security realm object;
providing a second partition security configuration including a realm attribute, wherein the value of the realm attribute of the second partition security configuration associates the second partition with the second security realm object;
associating a first primary identity domain with the first partition, wherein the first primary identity domain represents a first plurality of users associated with a first tenant;
associating a second primary identity domain with the second partition wherein the second primary identity domain represents a second plurality of users associated with a second tenant;
operating each of said admin security realm object, first security realm object, and second security realm object simultaneously at runtime of the multitenant application server environment to control authentication and authorization for access to said plurality of partition resources and said plurality of global resources;
whereby the first plurality of users associated with the first tenant are provided access to the first plurality of partition resources of the first partition via a service of the configuration of security services defined by the first security realm object, but not to the second plurality of partition resources of the second partition;
and
whereby the second plurality of users associated with the second tenant are provided access to the second plurality of partition resources of the second partition via a service of the configuration of security services defined by the second security realm object, but not to the first plurality of partition resources of the first partition.

10 more elements

A non-transitory computer-readable medium including instructions stored thereon for providing security in a multitenant application server environment comprising a plurality of partitions having a plurality of partition resources and a plurality of global resources, which instructions, when executed, cause a system to perform steps comprising:

providing, during runtime of the multitenant application server environment, a domain object that provides a domain configuration for the multitenant application server environment;
providing, as a child of the domain object, a security configuration object, wherein domain-wide services are configured on the security configuration object, and wherein the security configuration object includes a parent container for a plurality of realm objects;
providing a plurality of security realm objects including an admin security realm object, a first security realm object, and a second security realm object, wherein the first and second security realm objects are included in the parent container, and wherein each security realm object defines a configuration of security services;
configuring a first partition of the plurality of partitions to have a first plurality of partition resources of the plurality of partition resources;
configuring a second partition of the plurality of partitions to have a second plurality of partition resources of the plurality of partition resources;
providing a first partition security configuration including a realm attribute, wherein the value of the realm attribute of the first partition security configuration associates the first partition with the first security realm object;
providing a second partition security configuration including a realm attribute, wherein the value of the realm attribute of the second partition security configuration associates the second partition with the second security realm object;
associating a first primary identity domain with the first partition, wherein the first primary identity domain represents a first plurality of users associated with a first tenant;
associating a second primary identity domain with the second partition wherein the second primary identity domain represents a second plurality of users associated with a second tenant;
operating each of said admin security realm object, first security realm object, and second security realm object simultaneously at runtime of the multitenant application server environment to control authentication and authorization for access to said plurality of partition resources and said plurality of global resources;
whereby the first plurality of users associated with the first tenant are provided access to the first plurality of partition resources of the first partition via a service of the configuration of security services defined by the first security realm object, but not to the second plurality of partition resources of the second partition;
and
whereby the second plurality of users associated with the second tenant are provided access to the second plurality of partition resources of the second partition via a service of the configuration of security services defined by the second security realm object, but not to the first plurality of partition resources of the first partition.

10 more elements

A multitenant application server environment system comprising:

an application server environment comprising a plurality of microprocessors and memory;
a domain object, provided during runtime of the multitenant application server environment, that provides a domain configuration for the multitenant application server environment;
a security configuration object that is a child of the domain object, wherein domain-wide services are configured on the security configuration object, and wherein the security configuration object includes a parent container for a plurality of realm objects;
a plurality of partitions configured on said application server environment;
a plurality of partition resources and a plurality of global resources provided in said application server environment;
a plurality of security realm objects including an admin security realm object, a first security realm object, and a second security realm object configured in said application server environment, wherein the first and second security realm objects are included in the parent container, and wherein each security realm object defines a configuration of security services;
a first partition of the plurality of partitions configured to have a first plurality of partition resources of the plurality of partition resources;
a second partition of the plurality of partitions configured to have a second plurality of partition resources of the plurality of partition resources;
a first partition security configuration including a realm attribute, wherein the value of the realm attribute of the first partition security configuration associates the first partition with the first security realm object;
a second partition security configuration including a realm attribute, wherein the value of the realm attribute of the second partition security configuration associates the second partition with the second security realm object;
a first primary identity domain associated with the first partition, wherein the first primary identity domain represents a first plurality of users associated with a first tenant;
a second primary identity domain associated with the second partition wherein the second primary identity domain represents a second plurality of users associated with a second tenant;
wherein said admin security realm object, first security realm object, and second security realm object are configured to operate simultaneously at runtime of the multitenant application server environment to control authentication and authorization for access to said plurality of partition resources and said plurality of global resources;
whereby the first plurality of users associated with the first tenant are provided access to the first plurality of partition resources of the first partition via a service of the configuration of security services defined by the first security realm object, but not to the second plurality of partition resources of the second partition;
and
whereby the second plurality of users associated with the second tenant are provided access to the second plurality of partition resources of the second partition via a service of the configuration of security services defined by the second security realm object, but not to the first plurality of partition resources of the first partition.

13 more elements

Dependencies are inferred from the claim text.

Description10,719 words

Summary228 words

#A portion of the disclosure of this patent document contains material which is subject to copyright protection. The copyright owner has no objection to the facsimile reproduction by anyone of the patent document or the patent disclosure, as it appears in the Patent and Trademark Office patent file or records, but otherwise reserves all copyright rights whatsoever.

#Embodiments of the invention are generally related to application servers and cloud environments, and are particularly related to a system and method for providing security in a multitenant application server environment.

#Software application servers, examples of which include Oracle WebLogic Server (WLS) and Glassfish, generally provide a managed environment for running enterprise software applications. Recently, technologies have also been developed for use in cloud environments, which allow users or tenants to develop and run their applications within the cloud environment, and to take advantage of distributed resources provided by the environment.

Brief description of the drawings9 figures

#FIG. 1 illustrates a system for supporting multi-tenancy in an application server, cloud, or other environment, in accordance with an embodiment.

#FIG. 2 further illustrates a system for supporting multi-tenancy in an application server, cloud, or other environment, in accordance with an embodiment.

#FIG. 3 further illustrates a system for supporting multi-tenancy in an application server, cloud, or other environment, in accordance with an embodiment.

Detailed description10,312 words

#In accordance with an embodiment, the present invention provides for per-partition configuration of security services including configuration for authentication, authorization, credential mapping, auditing, password validation, certificate validation, and user lockout in a multi-tenant server environment. Embodiments of the present invention also provide for access control for partition and global resources such that applications deployed to a particular partition are accessible only to users of the particular partition; partition configuration for a particular partition is only available to the particular partition's administrator (and WebLogic administrator); and partition administrators only have read-only access to globally-visible resources and configuration. FIGS. 1-5 and the accompanying text describe a multi-tenant application server environment. FIGS. 6-8 and the accompany text describe a system and method for supporting security in a multi-tenant server environments such as described, for example, with respect to FIGS. 1-5.

#In the following description, the invention will be illustrated by way of example and not by way of limitation in the figures of the accompanying drawings. References to various embodiments in this disclosure are not necessarily to the same embodiment, and such references mean at least one. While specific implementations are discussed, it is understood that this is provided for illustrative purposes only. A person skilled in the relevant art will recognize that other components and configurations may be used without departing from the scope and spirit of the invention.

#Furthermore, in certain instances, numerous specific details will be set forth to provide a thorough description of the invention. However, it will be apparent to those skilled in the art that the invention may be practiced without these specific details. In other instances, well-known features have not been described in as much detail so as not to obscure the invention.

Facts

Application

15/403,396Filed 11 Jan 2017 · continuation

Priority

23 Jun 2014

Published

US 2017/0126742 A14 May 2017

Granted

9 Oct 2018

Term ends

23 Jun 2035

Estimated · how

20 years from earliest known nonprovisional domestic filing plus recorded patent term adjustment. Maintenance-fee lapses, terminal disclaimers and statutory extensions have not been checked. The continuity chain may be incomplete; this is not an enforceability determination.

Classification11 codes

G06F 21/62
Protecting data: protecting access to data via a platform, e.g. using keys or access control rules
G06F 16/278
Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system…: data…
G06F 21/604
Protecting data: tools and structures for managing or administering access control systems
H04L 47/70
Traffic control in data switching networks: admission control; Resource allocation

Family

Application62/016,058Us provisional application · filed 23 Jun 2014

Application62/054,912Us provisional application · filed 24 Sep 2014

Application14/747,778Parent of this continuation · filed 23 Jun 2015

US 2017/0126742 A1Pre-grant publication · published 4 May 2017

US 9,578,009 B2Parent of this continuation

US 2015/0373004 A1Published application

US 10,097,589 B2This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

23 Jun 2014Priority claimedParent application 62/016,058
11 Jan 2017Application filedUS 15/403,396
4 May 2017PublishedUS 2017/0126742 A1
9 Aug 2018Assigned to Oracle International Corporationassignment of assignor's interest
9 Oct 2018GrantedUS 10,097,589 B2
12 Oct 2026TodayWithin its term
23 Jun 2035Term endsEstimated

System and method for supporting security in a multitenant application server environment

Life of this patent

System and method for supporting security in a multitenant application server environment

Life of this patent

Life of this patent

Abstract

Drawings

Drawings

Claims20

Description10,719 words

Drawings

Classification11 codes

Life of this patent

Description10,719 words