Hot pluggable extensions for access management system

摘要

Embodiments described herein relate to extending the functionality of one or more access management servers, using plug-in files which may be uploaded while the servers are running. The plug-in files may be discovered in both the plug-in file's own class path and the server's class path, and then may be used in the server's authentication and other operations. In certain embodiments, the server's class path need not be modified during this process, and the server need not be shut down or restarted. Certain embodiments may implement a parallel class loader. Custom plug-in file code may be loaded by the parallel class loader, and the parallel class loader is started a container class loader may be made the parent of the parallel class loader.

主权项

1. A method, comprising:
maintaining, on an administrative server, a configuration store containing a plurality of entries associated with a plug-in, each entry of the plurality of entries associating the plug-in with a runtime state for that plug-in, the plurality of entries comprising:
a plurality of instance entries corresponding to a plurality of access management servers, each instance entry associating a runtime state with an instance of the plug-in executing on a particular access management server; anda master entry for the plug-in, the master entry associating a most recent runtime state applicable to all of the instances of the plug-in executing on all of the plurality of access management servers; receiving, at the administrative server, a command to transition runtime states of each instance of a plug-in from a first runtime state to a second runtime state; in response to receiving the command, sending, from the administrative server to each of the plurality of access management servers, an instruction to transition a runtime state of a plug-in instance associated with that access management server from the first runtime state to the second runtime state; receiving, at the administrative server, from each of two or more access management servers of the plurality of access management servers, a reply indicating whether a plug-in instance successfully transitioned from the first runtime state to the second runtime state; determining whether replies indicating a successful transition from the first runtime state to the second runtime state have been received from all of the plurality of access management servers; and in response to a determination that replies indicating a successful transition from the first runtime state to the second runtime state have been received from all of the plurality of access management servers:
updating the master entry for the plug-in; andclearing each of the plurality of instance entries for the plug-in, corresponding to each of the plurality of access management servers.