Service discovery for a multi-tenant identity and data security management cloud service

1. A method for providing cloud-based identity and access management, the method comprising:

provisioning, by a provisioning framework, a first service implemented by a first virtual machine, wherein a plurality of services implemented by virtual machines have been provisioned by the provisioning framework and a plurality of service discovery agents (SDAs) are implemented as common code kernels on virtual machines provisioned by the provisioning framework;

discovering, by a routing tier, metadata information from the provisioning framework about the first service implemented by the first virtual machine, wherein the routing tier includes routing nodes that comprise services implemented by virtual machines provisioned by the provisioning framework; and

configuring, by the routing tier, one or more traffic routes that include the first service implemented by the first virtual machine based on the discovered metadata information such that one or more SDAs implemented on the routing nodes configure the one or more traffic routes using the metadata information about the first service, wherein one or more identity management service requests are routed to the first service based on the configured one or more traffic routes.

2. The method of claim 1 , wherein the first service and the plurality of services provisioned by the provisioning framework comprise microservices, and metadata information about running microservices that have been provisioned is stored in a registry by the provisioning framework.

3. The method of claim 2 , wherein the metadata information comprises an internet protocol (IP) address of the first virtual machine that implements the first service.

4. The method of claim 2 , wherein the discovering of the metadata information about the first service comprises accessing, by one or more SDAs implemented on the routing nodes, the registry stored by the provisioning framework.

5. The method of claim 2 , wherein, after provisioning when the first service is running, an SDA of the first service performs discovery of other microservices provisioned by the provisioning framework by accessing the registry stored by the provisioning framework.

6. The method of claim 5 , wherein the first service is provisioned as a cache node.

7. The method of claim 6 , further comprising:

discovering, by the SDA of the first service, one or more cache nodes provisioned by the provisioning framework based on accessing the registry stored by the provisioning framework; and

forming a cache cluster with the discovered one or more cache nodes, wherein the formed cache cluster implements a remote cache.

8. The method of claim 7 , wherein metadata information stored in the registry about the remote cache is used by one or more SDAs on the plurality of virtual machines provisioned by the provisioning framework to reach the remote cache.

9. The method of claim 2 , wherein the metadata stored in the registry is updated upon a status change of the first service or the first virtual machine, and the status change comprises a node provisioning, a node de-provisioning, a node crash, a node hang, a service crash, a service hang, a service time-out, or a topology change.

10. The method of claim 1 , wherein the first virtual machine implements the first service as an instance of an identity management service.

11. The method of claim 1 , wherein the discovering by the routing tier is part of a periodic discovery that is iteratively performed to discover provisioned services.

12. The method of claim 1 , wherein, after provisioning, the SDA of the first service discovers one or more running cache services provisioned by the provisioning framework by accessing a registry that stores metadata information about running microservices that have been provisioned by the provisioning framework.

13. The method of claim 1 , wherein the provisioning framework polls virtual machines that implement services provisioned by the provisioning framework to determine provisioned services that are actively running.

14. A non-transitory computer readable medium having instructions stored thereon that, when executed by a processor, cause the processor to provide cloud-based identity and access management, the providing comprising:

provisioning, by a provisioning framework, a first service implemented by a first virtual machine, wherein a plurality of services implemented by virtual machines have been provisioned by the provisioning framework and a plurality of service discovery agents (SDAs) are implemented as common code kernels on virtual machines provisioned by the provisioning framework;

discovering, by a routing tier, metadata information from the provisioning framework about the first service implemented by the first virtual machine, wherein the routing tier includes routing nodes that comprise services implemented by virtual machines provisioned by the provisioning framework; and

configuring, by the routing tier, one or more traffic routes that include the first service implemented by the first virtual machine based on the discovered metadata information such that one or more SDAs implemented on the routing nodes configure the one or more traffic routes using the metadata information about the first service, wherein one or more identity management service requests are routed to the first service based on the configured one or more traffic routes.

15. The non-transitory computer readable medium of claim 14 , wherein the discovering by the routing tier is part of a periodic discovery that is iteratively performed to discover provisioned services.

16. The non-transitory computer readable medium of claim 14 , wherein, after provisioning, the SDA of the first service discovers one or more running cache services provisioned by the provisioning framework by accessing a registry that stores metadata information about running microservices that have been provisioned by the provisioning framework.

17. The non-transitory computer readable medium of claim 14 , wherein the provisioning framework polls virtual machines that implement services provisioned by the provisioning framework to determine provisioned services that are actively running.

18. A system for providing cloud-based identity and access management, comprising:

a provisioning framework implemented on one or more computing devices configured to provision a first service implemented by a first virtual machine, wherein a plurality of services implemented by virtual machines have been provisioned by the provisioning framework; and

a routing tier implemented on one or more computing devices configured to:

discover metadata information from the provisioning framework about the first service implemented by the first virtual machine, wherein the routing tier includes routing nodes that comprise services implemented by virtual machines provisioned by the provisioning framework; and

configure one or more traffic routes that include the first service implemented by the first virtual machine based on the discovered metadata information such that one or more SDAs implemented on the routing nodes configure the one or more traffic routes using the metadata information about the first service, wherein one or more identity management service requests are routed to the first service based on the configured one or more traffic routes.