Oracle International Corporation

Hari Sastry

Sirish V Vepa

Sreedhar Katti

Kanika Vats

Alan Cao

Cynthia Ding

Yi Wang

Vadim Lander

Ramaprakash Hosalli Sathyanarayan

Venkateswara Reddy Medam

Krishnakumar Sriramadhesikan

Rajesh Purushothaman

Xiaoxiao Xu

Manohari Neelakanteshwar

Vineet Garg

Loganathan Ramasamy

Anand Murugesan

Srivatsa Manjunath

Ajay Keni

Rakesh Keshava

Vinoth Janakiraman

Swathi Vinayak Shenoy

Michael Ray Frost

A method for mapping SCIM resources to LDAP entries is provided. An LDAP Directory Information Tree (DIT), including a plurality of LDAP DIT entries that describe LDAP containers, users and groups, is provided. Each LDAP DIT entry includes a Distinguished Name and a plurality of LDAP attribute-value pairs, each of which include an attribute name and one or more attribute values. A SCIM directory, including a plurality of SCIM resource entries, is also provided. Each SCIM resource entry includes a plurality of SCIM attributes, each of which includes a name and one or more values. The plurality of SCIM resource entries are converted to corresponding LDAP DIT entries, and, for each SCIM resource entry that has a SCIM CMVA, the SCIM CMVA is mapped to a plurality of LDAP attributes in the corresponding LDAP DIT entry using LDAP attribute subtypes.

SCIM to LDAP mapping using subtype attributes

A method for hierarchically processing Lightweight Directory Access Protocol (LDAP) operations against a System for Cross-domain Identity Management (SCIM) directory is provided. The method includes providing an LDAP Directory Information Tree (DIT) including a plurality of LDAP DIT entries that describe LDAP containers, users and groups, providing a SCIM directory including a plurality of SCIM resource entries that describe SCIM users and groups, migrating the plurality of LDAP DIT entries to the SCIM directory including storing the LDAP DIT hierarchical information in the SCIM directory by mapping LDAP containers in the LDAP DIT to special marker SCIM groups in the SCIM directory, receiving, from an LDAP-based application over a network, an LDAP operation request, processing the LDAP operation request, and returning an LDAP operation response to the LDAP-based application over the network.

Preserving LDAP hierarchy in a SCIM directory using special marker groups

A key store microservice is provided for a cloud based identity management system. The key store microservice receives, over a network, a request from a client application to retrieve a key, the request including a tenancy identifier, and determines whether the key is present in a tenant specific memory cache associated with the tenancy identifier. When the key is determined to be present in the tenant specific memory cache, the key store microservice retrieves the key from the tenant specific memory cache, retrieves a decryption key from a key wallet, decrypts the key retrieved from the tenant specific memory cache using the decryption key retrieved from the key wallet, and sends, over the network, the key to the client.

Key store service

A method for providing an on-premises virtual directory system for an LDAP (Lightweight Directory Access Protocol) to SCIM (System for Cross-domain Identity Management) proxy service is provided. The method includes providing an LDAP Directory Information Tree (DIT) including LDAP DIT entries, providing a SCIM directory including SCIM resource entries, migrating the LDAP DIT entries to the SCIM directory, creating a virtual LDAP hierarchy based on LDAP DIT hierarchical information stored in the SCIM directory, and displaying a graphical user interface (GUI) for a directory services application that includes a data tree pane that depicts the virtual LDAP hierarchy. Creating the virtual LDAP hierarchy includes storing the LDAP DIT hierarchical information in the SCIM directory by mapping LDAP containers to SCIM user or SCIM group attributes, mapping LDAP containers to special marker SCIM groups, mapping LDAP user DNs to SCIM user externalIDs, or mapping LDAP group DNs to SCIM group externalIDs.

Virtual directory system for LDAP to SCIM proxy service

A system for authorizing access to a resource receives a request for an access token that corresponds to the resource, where the request includes user information and application information. The user information includes a role of the user and the application information includes a role of the application. The system evaluates the request by computing scopes for the access token, including determining an intersection between the user information and the application information. The system then provides the access token that includes the computed scopes, the scopes being based at least on the role of the user and the role of the application.

Identity cloud service authorization model

A global policy store, in which policies applicable to multiple applications in an enterprise environment can be stored, can be stored in association with that environment. An application-level policy combining algorithm can be associated with a specific application to resolve conflicts between the results of evaluating policies that pertain to that application's resources. A persistent model is defined for an Extensible Access Control Markup Language (XACML) target definition.

Authorization policy objects sharable across applications, persistence model, and application-level decision-combining algorithm

Application customization enables many different types of customers, from small companies to large multinational enterprises, to use various applications provided by a cloud service provider. To accommodate these customizations, previous systems generally require manual human intervention to identify custom, customized, and cloud service provider authorization policies (also referred to herein as 'seed' authorization policies) and to decide how each type of authorization policy should be upgraded. When applications are customized, artifacts that represent those customizations can be created. In some embodiments, the customizations can include new resources or entitlements, and grants to new roles. In addition to new resources, entitlements, and grants, existing resources, entitlements, and grants can be modified and artifacts corresponding to those modifications can be generated. Embodiments of the present invention provide improved techniques for tracking and managing customizations to simplify and automate upgrade processes.

Authorization policy customization and authorization policy lockdown

Systems and methods for providing consistent metadata in a cluster database system are disclosed. Each node contains a number of LDAP server instances, as well as a monitor process. Each node contains a node shared memory, and the cluster contains a cluster shared memory stored on a directory store. When a client alters metadata in one of the LDAP server instances, the LDAP server instances writes the changes to the directory store, and provides update information, such as a version number, to the node shared memory. Other server instances on that node poll the node shared memory to determine whether updates have been made. If updates have been made, the other server instances update their on-heap caches based on the directory store. Each monitor process determines whether changes have been made to the cluster shared memory, and if so, updates the node shared memory based on the directory store.

System for persistent caching of LDAP metadata in a cluster LDAP server topology

Growing community of inventors

San Jose, CA, United States of America

Hari Sastry