Oracle International Corporation

Helali Bhuiyan

Daniel Music Vogel

Geoff Hopcraft

Gayathri Premachandran

Jinai A

A policy management service receives a request for an authorization policy in a language-localized syntax. The policy management service identifies a syntax graph corresponding to the authorization policy and traverses the syntax graph to obtain at least a requestor variable value associated with the authorization policy, an action variable value associated with the authorization policy, a resource variable value associated with the authorization policy, and a location variable value associated with the authorization policy. The policy authorization service generates a reader-friendly policy statement in the language localized syntax using the requestor variable value, the action variable value, the resource variable value, and the location variable value. Responsive to the request, the policy authorization service provides the reader-friendly policy statement.

Language-localized policy statements

Techniques for generating and using reader-friendly policy statements are disclosed. In one or more embodiments, a policy management service receives a request for an authorization policy in a language-localized syntax. The policy management service identifies a syntax graph corresponding to the authorization policy and traverses the syntax graph to obtain at least a requestor variable value associated with the authorization policy, an action variable value associated with the authorization policy, a resource variable value associated with the authorization policy, and a location variable value associated with the authorization policy. The policy authorization service generates a reader-friendly policy statement in the language-localized syntax using the requestor variable value, the action variable value, the resource variable value, and the location variable value. Responsive to the request, the policy authorization service provides the reader-friendly policy statement.

Systems, methods, and other embodiments associated with controlling a multi-tenant service-oriented architecture are described. In one embodiment, a method includes providing a collection of policies based upon who can access information of a user, wherein the information of the user is managed by a second service. A multi-tenant control module determines if a first service is able to contact the second service and obtain access to the user's information through the second service. An authentication service works in conjunction with the first and second services to assist in determining if the first service is able to contact the second service and obtain access to the user's information through the second service.

System and method for controlling a multi-tenant service-oriented architecture

Techniques for making preliminary authorization determinations based on partial contextual information are disclosed. In one or more embodiments, an API receives an authorization request and partial contextual information associated with the authorization request. The API submits the partial contextual information to an authorization service, without submitting complete contextual information associated with the authorization request. The API receives, from the authorization service, a preliminary authorization response based on the partial contextual information. The preliminary authorization includes one of (a) denial of the authorization request and (b) non-denial of the authorization request. Based on the authorization request including non-denial of the authorization request, the API further processes the authorization request by obtaining a final authorization result based on the complete contextual information associated with the authorization request and, responsive to the authorization request, providing the final authorization result.

Partial-context policy enforcement

Techniques for generating syntax graphs corresponding to user-defined policy statement are disclosed. In one or more embodiments, a policy management service receives a user-defined policy statement that includes a requestor variable value, an action variable value, a resource variable value, and a location variable value. The user-defined policy statement describes an authorization policy. The policy authorization service converts the user-defined policy statement to a canonical policy statement, which involves: mapping the requestor variable value to a unique system-wide requestor identifier, and mapping the location variable value to a unique system-wide location identifier. The policy management service generates a syntax graph of the canonical policy statement. The syntax graph is traversable to determine whether the authorization policy is satisfied for a particular authorization request. The policy management service stores the syntax graph for use by an authorization service.

Policy storage using syntax graphs

Techniques for evaluating authorization requests using cached policy data are disclosed. In one or more embodiments, a thick client receives an authorization request. The thick client evaluates the authorization request, based on partial contextual information associated with the authorization request and a local policy data cache, to generate a preliminary authorization response. The preliminary authorization response includes one of (a) denial of the authorization request and (b) non-denial of the authorization request. Responsive to the preliminary authorization response including non-denial of the authorization request, the thick client submits complete contextual information associated with the authorization request to an authorization service. The authorization service provides a final authorization result, which the thick client uses to grant or deny the authorization request.

Growing community of inventors

Redmond, WA, United States of America

Helali Bhuiyan