Cookie based state propagation for a multi-tenant identity cloud service
A system that provides cloud based identity management, at a first microservice, saves a current state on a cookie that is stored on a browser, where the current state is saved in a format specific to the first microservice. The system performs an operation on the first microservice that generates a first portion of information and a second portion of information. The system stores the first portion of information related to the operation on the cookie, the first portion including the current state. The system provides a second portion of information related to the operation to a second microservice as a query parameter on a redirect Uniform Resource Locator (“URL”), where the second portion is removed from the cookie.
1. A non-transitory computer readable medium having instructions stored thereon that, when executed by a processor, cause the processor to provide cloud based identity management, the providing comprising:
at a first microservice, saving a current state on a cookie that is stored on a browser, wherein the current state is saved in a format specific to the first microservice;
performing an operation, on the first microservice, that generates a first portion of information and a second portion of information;
storing the first portion of information, related to the operation, on the cookie, the first portion comprising the current state; and
providing a second portion of information, related to the operation, to a second microservice as a query parameter on a redirect Uniform Resource Locator (URL), wherein the second portion is removed from the cookie.
2. The non-transitory computer readable medium of claim 1 , wherein the first microservice is a Single Sign On (SSO) microservice and the second microservice is a Security Assertion Markup Language (SAML) microservice.
3. The non-transitory computer readable medium of claim 2 , wherein the operation is an authentication function, wherein the second portion of information comprises a result of the authentication function.
4. The non-transitory computer readable medium of claim 3 , wherein the result of the authentication function is provided by the query parameter.
5. The non-transitory computer readable medium of claim 1 , wherein the format specific to the first microservice cannot be read by other microservices.
6. The non-transitory computer readable medium of claim 1 , the providing further comprising a request cookie for authentication requests and a session cookie for microservice states.
7. The non-transitory computer readable medium of claim 6 , wherein the request cookie and the session cookie are each encrypted with keys that are changed on a predetermined time period.
8. A system for providing cloud based identity and access management, comprising:
a plurality of tenants;
a plurality of microservices; and
one or more processors that:
at a first microservice, save a current state on a cookie that is stored on a browser, wherein the current state is saved in a format specific to the first microservice;
perform an operation, on the first microservice, that generates a first portion of information and a second portion of information;
store the first portion of information, related to the operation, on the cookie, the first portion comprising the current state; and
provide a second portion of information, related to the operation, to a second microservice as a query parameter on a redirect Uniform Resource Locator (URL), wherein the second portion is removed from the cookie.
9. The system of claim 8 , wherein the first microservice is a Single Sign On (SSO) microservice and the second microservice is a Security Assertion Markup Language (SAML) microservice.
10. The system of claim 9 , wherein the operation is an authentication function, wherein the second portion of information comprises a result of the authentication function.
11. The system of claim 10 , wherein the result of the authentication function is provided by the query parameter.
12. The system of claim 8 , wherein the format specific to the first microservice cannot be read by other microservices.
13. The system of claim 8 , the processors further generating a request cookie for authentication requests and a session cookie for microservice states.
14. The system of claim 13 , wherein the request cookie and the session cookie are each encrypted with keys that are changed on a predetermined time period.
15. A method of providing cloud based identity management, the method comprising:
at a first microservice, saving a current state on a cookie that is stored on a browser, wherein the current state is saved in a format specific to the first microservice;
performing an operation, on the first microservice, that generates a first portion of information and a second portion of information;
storing the first portion of information, related to the operation, on the cookie, the first portion comprising the current state; and
providing a second portion of information, related to the operation, to a second microservice as a query parameter on a redirect Uniform Resource Locator (URL), wherein the second portion is removed from the cookie.
16. The method of claim 15 , wherein the first microservice is a Single Sign On (SSO) microservice and the second microservice is a Security Assertion Markup Language (SAML) microservice.
17. The method of claim 16 , wherein the operation is an authentication function, wherein the second portion of information comprises a result of the authentication function.
18. The method of claim 17 , wherein the result of the authentication function is provided by the query parameter.
19. The method of claim 15 , wherein the format specific to the first microservice cannot be read by other microservices.
20. The method of claim 15 , further comprising a request cookie for authentication requests and a session cookie for microservice states.