Oracle International Corporation

Sreedhar Katti

Sirish V Vepa

Vadim Lander

Mohamad Raja Gani Mohamad Abdul

Harsh Maheshwari

Sidhartha Das

Rajesh Pakkath

Rakesh Keshava

Hari Sastry

Prateek Mishra

Thomas James Andrews

Jason Anthony Slepicka

Ayman Mohammed Aly Hassan Elmenshawy

A M Helali Mortuza Bhuiyan

Eswar Vandanapu

Jakub Karol Wojciak

Kenneth Choi Kil

Varanasi Kumar Ravi

Swathi Vinayak Shenoy

Weng Cheong

Harold William Lockhart

Pritesh Kiritkumar Patel

Maheshkumar Shivlal Dhaduk

A system is disclosed that includes capabilities by which a nested sub-resource residing in a service tenancy can access a customer-owned resource residing in a customer tenancy without the use of a cross-tenant policy. The disclosed system provides the ability for a nested sub-resource residing in a service tenancy to obtain the resource principal identity of a higher-level resource residing in the customer tenancy and use the identity of the higher-level resource to access a customer-owned resource residing in the customer tenancy. Using the resource principal identity of its higher-level resource, the sub-resource can access a customer-owned resource that resides in a customer tenancy in a seamless way without having to write a cross-tenancy policy statement that provides permission to the sub-resource to access the customer-owned resource.

Nested resource identity management for cloud resources

Embodiments are directed to managing cryptographic keys in a multi-tenant cloud based system. Embodiments receive from a client a request for a wrapped data encryption key ('DEK'). Embodiments generate a random key and fetch encryption context that corresponds to the client. Embodiments generate the wrapped DEK including the random key and the encryption context encoded in the wrapped DEK. Embodiments then return the wrapped DEK to the client.

Cloud based key management

The present disclosure relates generally to managing access to an enterprise system using remote devices. Techniques are disclosed for provisioning applications on remote devices to access resources in an enterprise system. Specifically, applications may be automatically configured with access information (e.g., account information) and connection information to access a resource in an enterprise system using a remote device. Configuring an application may include determining an account for accessing a resource using the application. An account may be provisioned if one has not been established. Upon configuring an application, the device access management system may provide a configured application to the remote device(s) for which the application is configured. Once the configured application is received, the application may be automatically installed on the remote device, after which the application may be executed to access a resource.

Unified provisioning of applications on devices in an enterprise system

A system for authorizing access to a resource associated with a tenancy in an identity management system that includes a plurality of tenancies receives an access token request for an access token that corresponds to the resource, the request including user information and application information, the user information including roles of a user and the application information including roles of the application. The system evaluates the access token request by computing dynamic roles and corresponding dynamic scopes for the access token including a second intersection between the dynamic roles of the user and the dynamic roles of the application. The system then provides the access token that includes the computed static scopes, where the scopes are based at least on the roles of the user and the roles of the application, and further including the computed dynamic roles and corresponding dynamic scopes.

Identity cloud service authorization model with dynamic roles and scopes

Key generation and roll over is provided for a cloud based identity management system. A key set is generated that includes a previous key and expiration time, a current key and expiration time, and a next key and expiration time, and stores the key set in a database table and a memory cache associated with the database table. At the current key expiration time, the key set is rolled over, including retrieving the key set from the database table, updating the previous key and expiration time with the current key and expiration time, updating the current key and expiration time with the next key and expiration time, generating a new key and expiration time, updating the next key and expiration time with the new key and expiration time, and updating the key set in the database table and the memory cache.

Key generation and rollover

A key store microservice is provided for a cloud based identity management system. The key store microservice receives, over a network, a request from a client application to retrieve a key, the request including a tenancy identifier, and determines whether the key is present in a tenant specific memory cache associated with the tenancy identifier. When the key is determined to be present in the tenant specific memory cache, the key store microservice retrieves the key from the tenant specific memory cache, retrieves a decryption key from a key wallet, decrypts the key retrieved from the tenant specific memory cache using the decryption key retrieved from the key wallet, and sends, over the network, the key to the client.

Key store service

A system for authorizing access to a resource receives a request for an access token that corresponds to the resource, where the request includes user information and application information. The user information includes a role of the user and the application information includes a role of the application. The system evaluates the request by computing scopes for the access token, including determining an intersection between the user information and the application information. The system then provides the access token that includes the computed scopes, the scopes being based at least on the role of the user and the role of the application.

Identity cloud service authorization model

A plug-in framework is invoked within a plug-in, where the plug-in framework includes a software library configured to define, register, and configure plug-ins, where the plug-in includes a software module that extends or customizes functionality of a software application that is external to the plug-in, and where the plug-in includes a mapping name. A plug-in instance declaration is searched, by the plug-in framework, for a mapping that includes the mapping name, where the plug-in instance declaration is located within a plug-in file, and where the plug-in declaration comprises one or more mappings. When a mapping of the mapping name to the value is found, the value is returned, by the plug-in framework, to the plug-in based on the mapping. The plug-in framework also allows a plug-in provider to associate a plug-in with metadata.

Plug-in system for software applications

Growing community of inventors

Karnataka, India

Sreedhar Katti