Zuora, Inc.

Shown is single sign-on support access to tenant accounts in a multi-tenant service platform involving a proxy user account in an identity provider for a tenant account on the service platform having security metadata associated therewith, mapping in the identity provider maps a support user to a proxy user identifier, a corresponding security endpoint in the service platform and mapping of the proxy user account identifier to the tenant account and security metadata. The identity provider authenticates a request to access the tenant account on the service platform, obtains the security credentials for the proxy user identifier, and sends a security assertion with the proxy user identifier and the security metadata to the security endpoint. The endpoint receives and validates the security assertion against the mapping for the proxy user identifier to the tenant account and the security metadata in the service platform, and permits access by the support user to the tenant account in the service platform.

Receive, by a central controller engine, a user request to perform one or more operations associated with user data, wherein the user data includes first data and second data. Select, by the central controller engine based on the user request, a first service provider interface (SPI) integrated into a first service, the first SPI being configured to operate on the first data in a first datastore associated with the first service. The first SPI including a first service interface component configured based on a uniform access specification. Obtain, by the first SPI, the first data, the first data being formatted according to a first service data specification. Transform, by the first SPI based on the uniform access specification, the first data, thereby generating transformed first data formatted according to the uniform access specification. Provide, by the first SPI, the transformed first data to a target service.

Systems and methods providing authentication in a microservice system. In some embodiments, the method comprises receiving, from the user interface application, a user interface response corresponding to the user interface request; and sending the user interface response to the client computer. Some embodiments comprise when no cache entry corresponding to the user interface session token is present in the user interface session cache, directing the user interface request to a login service. Some embodiments comprise when the login service receives valid login credentials from the client computer, sending a new user interface session token to the client computer. Some embodiments comprise invalidating the cache entries in the user interface session cache according to a cache expiry policy; and determining whether the cache entry corresponding to the particular user interface session token is valid. In some embodiments, the user interface request session token consists of a single value.

Receive, by a central controller engine, a user request to perform one or more operations associated with user data, wherein the user data includes first data and second data. Select, by the central controller engine based on the user request, a first service provider interface (SPI) integrated into a first service, the first SPI being configured to operate on the first data in a first datastore associated with the first service. The first SPI including a first service interface component configured based on a uniform access specification. Obtain, by the first SPI, the first data, the first data being formatted according to a first service data specification. Transform, by the first SPI based on the uniform access specification, the first data, thereby generating transformed first data formatted according to the uniform access specification. Provide, by the first SPI, the transformed first data to a target service.

Systems and methods providing authentication in a microservice system. In some embodiments, the method comprises receiving, from the user interface application, a user interface response corresponding to the user interface request; and sending the user interface response to the client computer. Some embodiments comprise when no cache entry corresponding to the user interface session token is present in the user interface session cache, directing the user interface request to a login service. Some embodiments comprise when the login service receives valid login credentials from the client computer, sending a new user interface session token to the client computer. Some embodiments comprise invalidating the cache entries in the user interface session cache according to a cache expiry policy; and determining whether the cache entry corresponding to the particular user interface session token is valid. In some embodiments, the user interface request session token consists of a single value.

Shown is single sign-on support access to tenant accounts in a multi-tenant service platform involving a proxy user account in an identity provider for a tenant account on the service platform having security metadata associated therewith, mapping in the identity provider maps a support user to a proxy user identifier, a corresponding security endpoint in the service platform and mapping of the proxy user account identifier to the tenant account and security metadata. The identity provider authenticates a request to access the tenant account on the service platform, obtains the security credentials for the proxy user identifier, and sends a security assertion with the proxy user identifier and the security metadata to the security endpoint. The endpoint receives and validates the security assertion against the mapping for the proxy user identifier to the tenant account and the security metadata in the service platform, and permits access by the support user to the tenant account in the service platform.

Systems and methods providing authentication in a microservice system. In some embodiments, the method comprises receiving, from the user interface application, a user interface response corresponding to the user interface request; and sending the user interface response to the client computer. Some embodiments comprise when no cache entry corresponding to the user interface session token is present in the user interface session cache, directing the user interface request to a login service. Some embodiments comprise when the login service receives valid login credentials from the client computer, sending a new user interface session token to the client computer. Some embodiments comprise invalidating the cache entries in the user interface session cache according to a cache expiry policy; and determining whether the cache entry corresponding to the particular user interface session token is valid. In some embodiments, the user interface request session token consists of a single value.

Receive, by a central controller engine, a user request to perform one or more operations associated with user data, wherein the user data includes first data and second data. Select, by the central controller engine based on the user request, a first service provider interface (SPI) integrated into a first service, the first SPI being configured to operate on the first data in a first datastore associated with the first service. The first SPI including a first service interface component configured based on a uniform access specification. Obtain, by the first SPI, the first data, the first data being formatted according to a first service data specification. Transform, by the first SPI based on the uniform access specification, the first data, thereby generating transformed first data formatted according to the uniform access specification. Provide, by the first SPI, the transformed first data to a target service.

Shown is single sign-on support access to tenant accounts in a multi-tenant service platform involving a proxy user account in an identity provider for a tenant account on the service platform having security metadata associated therewith, mapping in the identity provider maps a support user to a proxy user identifier, a corresponding security endpoint in the service platform and mapping of the proxy user account identifier to the tenant account and security metadata. The identity provider authenticates a request to access the tenant account on the service platform, obtains the security credentials for the proxy user identifier, and sends a security assertion with the proxy user identifier and the security metadata to the security endpoint. The endpoint receives and validates the security assertion against the mapping for the proxy user identifier to the tenant account and the security metadata in the service platform, and permits access by the support user to the tenant account in the service platform.

Receive, by a central controller engine, a user request to perform one or more operations associated with user data, wherein the user data includes first data and second data. Select, by the central controller engine based on the user request, a first service provider interface (SPI) integrated into a first service, the first SPI being configured to operate on the first data in a first datastore associated with the first service. The first SPI including a first service interface component configured based on a uniform access specification. Obtain, by the first SPI, the first data, the first data being formatted according to a first service data specification. Transform, by the first SPI based on the uniform access specification, the first data, thereby generating transformed first data formatted according to the uniform access specification. Provide, by the first SPI, the transformed first data to a target service.