Oracle International Corporation

Ramaprakash Hosalli Sathyanarayan

Himanshu Sharma

Arun Theebaprakasam

Buddhika Kottahachchi

Sudhir Kumar Srinivasan

Olaf Stullich

Fannie Ho

Srikant Krishnapuram Tirumalai

Zhe Wang

Kuang-Yu Shih

Hari Sastry

Ajay Keni

Zhuoxing Mao

Kwan-I Lee

Techniques for managing privileged accounts via a privileged access management service are provided. In some examples, the service may be configured with a plug-in framework for accessing secure resources. In some aspects, a log-in request that includes authentication information and corresponds to the service may be received. Session access to at least one secure resource may be provided when a user is authenticated. In some examples, a request to perform an action associated with the secure resource may be received during the session. Additionally, in some examples, the plug-in framework may be implemented to determine whether the user is allowed to perform the action. Further, performance of the action may be allowed or denied during the session based on the determination.

Privileged account plug-in framework&#x2014;usage policies

A system and method can monitor one or more user sessions on a target system in a computing environment. An account managing system can capture a plurality of user session screen captures that are associated with said one or more user sessions on the target system. Furthermore, the account managing system can compare a user session screen capture, which is captured at a time during said one or more user sessions, with one or more user session screen captures that are recorded before the time. Then, the account managing system can record said user session screen capture if the target system is determined to be active at the time when said user session screen capture is captured.

System and method for optimizing visual session recording for user account management in a computing environment

A system and method can support user account management in a computing environment. The computing environment can include a video encoding pool to support load balancing and a managing server, such as a privileged account manager server. The video encoding pool includes a set of nodes that are able to perform one or more video processing tasks for another node. Furthermore, the managing server can receive a request from a managed node in the computing environment for delegating a video processing task, and can select one or more nodes from the video encoding pool to load balance and to perform the video processing task.

System and method for supporting video processing load balancing for user account management in a computing environment

Techniques for managing privileged accounts via a privileged access management service are provided. In some examples, the service may be configured with a plug-in framework for accessing secure resources. In some aspects, plug-in code for implementing a workflow that includes step-up validation associated with a user attempting to access at least one secure resource may be received. Access to the at least one secure resource may be provided when the user is authenticated with respect to the service. In some examples, a request to access a second secure resource may be received. Additionally, in some examples, the workflow to perform the step-up validation may be implemented at least in response to the request to access the second secure resource. The workflow implemented based at least in part on an attribute associated with the request.

Privileged account plug-in framework-step-up validation

A system and method can support user account management in a computing environment. A managing server, such as a privileged account manager server, can use an agent to manage a target system in the computing environment. The agent on the target system can initiate a video processing task based on a plurality of user session screens recorded on the target system, wherein the video processing task encodes the plurality of user session screens into a video. Furthermore, the agent can determine whether a resource usage for performing the video processing task on the target system exceeds a threshold. Then, the agent can dynamically offload the video processing task to a managing server that operates to manage the target system, if the resource usage for performing the video processing task on the target system exceeds the threshold.

System and method for supporting dynamic offloading of video processing for user account management in a computing environment

A system and method can support user account management in a computing environment. A user account manager can configure one or more recording policies, wherein said one or more recording policies operates to define detailed information on how user activities on a target system should be recorded. Furthermore, the user account manager can provide said one or more recording policies to one or more visual session recording processes associated with the target system. Then, the user account manager can use said one or more visual session recording processes to record activities in a user session on the target system based on said one or more recording policies.

System and method for using policies to support session recording for user account management in a computing environment

A system and method can support user account management in a computing environment. The computing environment can include a video encoding pool to support load balancing and a managing server, such as a privileged account manager server. The video encoding pool includes a set of nodes that are able to perform one or more video processing tasks for another node. Furthermore, the managing server can receive a request from a managed node in the computing environment for delegating a video processing task, and can select one or more nodes from the video encoding pool to load babalance and to perform the video processing task.

Techniques for managing accounts are provided. An access management system may check out credentials for accessing target systems. For example a user may receive a password for a period of time or until checked back in. Access to the target system may be logged during this time. Upon the password being checked in, a security account may modify the password so that the user may not log back in without checking out a new password. Additionally, in some examples, password policies for the security account may be managed. As such, when a password policy changes, the security account password may be dynamically updated. Additionally, in some examples, hierarchical viewing perspectives may be determined and/or selected for visualizing one or more managed accounts. Further, accounts may be organized into groups based on roles, and grants for the accounts may be dynamically updated as changes occur or new accounts are managed.

Privileged account manager, access management

Systems and methods for providing consistent metadata in a cluster database system are disclosed. Each node contains a number of LDAP server instances, as well as a monitor process. Each node contains a node shared memory, and the cluster contains a cluster shared memory stored on a directory store. When a client alters metadata in one of the LDAP server instances, the LDAP server instances writes the changes to the directory store, and provides update information, such as a version number, to the node shared memory. Other server instances on that node poll the node shared memory to determine whether updates have been made. If updates have been made, the other server instances update their on-heap caches based on the directory store. Each monitor process determines whether changes have been made to the cluster shared memory, and if so, updates the node shared memory based on the directory store.

System for persistent caching of LDAP metadata in a cluster LDAP server topology

Archival in a computer is performed by creating a process if an item to be copied is a directory, and alternatively by copying the item if the item is a file. The created process in turn recursively performs the just-described acts, e.g. the act of creating or copying, with another item located in the just-described directory. Therefore, depending on the number of directories to be copied, a corresponding number of processes may be created, which speeds up copying. A default limit on a resource available to a copy process may be set to a maximum limit for the resource, for speedy copying. Archival may be speeded up by transferring data from the file into a temporary buffer, locking the temporary buffer, and invoking a direct memory access (DMA) process. Archival may be speeded up also by checking for and eliminating the copying of circular links (such as a symbolic link that points to itself). Such a created process may send an email message if a resource at a destination is full, and wait to be restarted subsequent to sending the email message. A user that receives the email message makes appropriate arrangements (e.g. deletes files in a destination disk or loads a new disk), and therafter restarts the stopped process. On being restarted, the process recopies a file if it was in the middle of copying the file when it was stopped.

Growing community of inventors

Cupertino, CA, United States of America

Ramaprakash Hosalli Sathyanarayan