Oracle International Corporation

Pulse Secure, LLC

Juniper Networks, Inc.

Andy Tsang

Roger Allen Chickering

Jeffrey Charles Venable, Sr

Clifford E Kahn

Thomas B Remahl

Richard Sinn

Chi-Cheng Lee

Bob Summers

Brandon Barber

A device may include an authentication server and a server. The authentication server may receive a first form of a password from a client device in accordance with an authentication protocol, and authenticate the client device based on a comparison of the first form to a value derived from a second form of the password stored in a password database, where the comparison fails when the first form is not comparable to a value derived from the second form. The server may establish a secure connection to the client, receive a plain-text password from the client device over the secure connection, authenticate the client device by comparing a value derived from the plain-text password with a value derived from the second form, and update the password database with a third form of the password that permits the authentication server to successfully authenticate the client device when the authentication server receives the first form.

Updating stored passwords

A device may include an authentication server and a server. The authentication server may receive a first form of a password from a client in accordance with an authentication protocol, and authenticate the client based on a comparison of the first form to a value derived from a second form of the password stored in a password database. The comparison fails when the first form is not comparable to a value derived from the second form. The server may establish a secure connection to the client, receive a plain-text password from the client over the secure connection, authenticate the client by comparing a value derived from the plain-text password with a value derived from the second form, and update the password database with a third form of the password that permits the authentication server to successfully authenticate the client when the authentication server receives the first form.

Technology is disclosed for supporting multiple data stores. The set of data stores can be of a uniform type, or the various data stores can be different types (e.g. Lightweight Directory Access Protocol (LDAP), Structured Query Language (SQL), etc.). One implementation of the disclosed technology is with an Identity System. Another implementation is with an integrated Identity System and Access System. Various embodiments of the present invention utilize different means to separate the business logic of a system from the data access logic so that different types of data stores can be used without changing the business logic.

Support for multiple data stores

Systems and methods are provided for multi-language support through the management of multi-valued attributes. A data store maintains multi-valued attributes having language components and value components. The value components specify language specific values for the attributes and can be associated with corresponding language components. A server in communication with the data store can provide outputs to requesting users in accordance with a preferred language. For example, a request to access an identity profile maintained by an Identity System can be fulfilled by constructing a page or other output including the requested profile data. An Identity Server can construct the output to include attribute values corresponding to the preferred language associated with the request. Attribute configuration data can similarly be maintained with language components and value components. The configuration of an attribute such as its display name can be included in an output in accordance with a preferred language.

Multi-language support for enterprise identity and access management

Data is acquired for an Identity System based on a one or more rules. The data can be from the same Identity System Component, another Identity System Component or a component external to the Identity System. The acquired data can be used to populate an Identity Profile, configure a workflow, or provide information to any other object, process, component, etc. of the Identity System. In one embodiment, the present invention combines dynamic identity value substitution and directory filter rules to enable rule based identity management. It enables dynamic population of identity data and real-time routing for identity management workflows. In other embodiments, the present invention can be applied to systems other than Identity Systems.

Rule based data management

Technology is disclosed for accessing multiple network resources through a single portal. A Portal Bridge directs requests from the portal to multiple network resources and channels responses from the network resources to the portal. The Portal Bridge receives a request from a portal that calls for a response from a targeted network resource. The Portal Bridge forwards a request to the targeted network resource to obtain the response sought by the portal's request. The Portal Bridge receives a response to the request from the targeted network resource. The Portal Bridge processes the response and forwards the processed response to the portal. During processing, the Portal Bridge replaces links in the response with links to the Portal Bridge. This enables the Portal Bridge to receive and properly route any portal requests arising out of the links.

Growing community of inventors

San Jose, CA, United States of America

Andy Tsang