Jpmorgan Chase Bank, N.a.

Isaac Leonardo Blum

Michael George Norman

David Laurance

Michael D Ackerman

Kabron Austin Kline

Carl Milton Dashfield

Carl Dashfield

Roger F Bigger

Brian Dillon

Afzaal Syed

Corey Lansford

Douglas J Symalla

Richard Seidenstein

A method for governing a policy for providing access to a system is provided. The method includes: receiving a plurality of policy data units, each respective policy data unit including information that relates to an access determination with respect to the system; processing the plurality of policy data units by constructing a first directed graph of policy data unit processors, and obtaining an access policy rule as a result of the processing; evaluating the obtained access policy rule across a compute environment that is distributed in time and space by using the first directed graph; generating a signed access token that relates to a predetermined user based on the obtained access policy rule; and transmitting the signed access token to the predetermined user.

Method and system for providing access control governance

A method for validating an access request with respect to an application is provided. The method includes: receiving an access request from a user with respect to an application; retrieving, from a memory, group identification information that relates to at least one group to which the user belongs; retrieving, from the memory, scope information that indicates qualifications and/or characteristics of a relationship between the user and the at least one group; and generating a token that notifies the application of the group identification information and the scope information, and is usable by the application for validating the access request. The method may be implemented in an Active Directory Federation Services (AD FS) environment.

Method for provision of access grant

Systems and methods for provisioning a new secondary IdentityIQ instance to an existing IdentityIQ instance are disclosed. In one embodiment, a method may include: receiving a request to provision the new secondary IdentityIQ instance; creating a primary IdentityIQ instance for the existing IdentityIQ instance and the new secondary IdentityIQ instance; aggregating data from the existing IdentityIQ instance to the primary IdentityIQ instance; deploying an event handler to the primary IdentityIQ instance to handle incoming requests for the existing IdentityIQ instance; changing a reconciliation process and an audit process from the existing IdentityIQ instance to the primary IdentityIQ instance thereby changing the existing IdentityIQ instance to the secondary IdentityIQ instance for the primary IdentityIQ instance; deploying the new secondary IdentityIQ instance to the primary IdentityIQ instance; and deploying at least one application to the new secondary IdentityIQ instance based on an operation processed by the new secondary IdentityIQ instance.

Systems and methods for provisioning a new secondary IdentityIQ instance to an existing IdentityIQ instance

Growing community of inventors

Armonk, NY, United States of America

Isaac Leonardo Blum