Oracle International Corporation

Sudhir Kumar Srinivasan

Venkateswara Reddy Medam

Himanshu Sharma

Kuang-Yu Shih

Arun Theebaprakasam

Ramaprakash Hosalli Sathyanarayan

Buddhika Kottahachchi

Fannie Ho

Balakumar Balu

Gregg Alan Wilson

Olaf Stullich

Xiaoxiao Xu

Nikhil Yograj Vaishnavi

Shruthi Chikkanna

Zhuoxing Mao

Raghavendra Saravanamurthy

Embodiments include a multi-tenant cloud-based identity management system for a plurality of tenants. Embodiments include a global database providing a first set of resources to the plurality of tenants and a plurality of tenant databases, each tenant database providing a second set of resources to one of the plurality of tenants. Embodiments further include a plurality of resources accessible by the tenants and an automated upgrade framework for upgrading the global database and the tenant databases in response to an upgrade of a first release of the system to a second release of the system. For the automated upgrade framework, embodiments determine resource changes between the first release and the second release, generate an upgrade patch based on the resource changes and apply the upgrade patch to the global database.

Automated database upgrade for a multi-tenant identity cloud service

Embodiments operate a multi-tenant cloud system. At a first data center, embodiments authenticate a first client corresponding to a first tenant ID and store resources that correspond to the first client, the first data center in communication with a second data center that is configured to authenticate the first client and replicate the resources. The first data center receives an Application Programming Interface ('API') request for the first client corresponding to a change to the resources, and generates a change log and corresponding change event message in response to the API request. Embodiments compute a first hash corresponding to the first tenant ID of the change log to determine a first partition of a first queue at the first data center. The first data center pushes the change event message to the second data center via an API call.

Data replication conflict detection and resolution for a multi-tenant identity cloud service

Embodiments operate a multi-tenant cloud system. At a first data center, embodiments authenticate a first client and store resources that correspond to the first client, the first data center in communication with a second data center that is configured to authenticate the first client. Embodiments divide the resources into base data and regular data, where the base data is a minimum data needed to allow the resources to be available to the first client at the second data center. Embodiments store the base data on a cloud storage in a base data export file and store the regular data on the cloud storage in a regular data export file. Embodiments export the base data export file to the second data center and when the exporting the base data export file has completed, exports the regular data export file to the second data center.

Tenant replication bootstrap for a multi-tenant identity cloud service

A system stores and uses object relationships in a multi-tenant cloud-based identity and access management (IAM) system by: defining a schema for storing related objects, where the schema includes reference attributes indicative of relationships between the related objects in a database, and the schema defines a relationship type and a persistence scope for each reference attribute; constructing an in-memory representation of the related objects and their relationships based on the schema, where the in-memory representation indicates the relationship type and the persistence scope for each reference attribute; and using the in-memory representation of the related objects to perform an IAM service for a client of the multi-tenant cloud-based IAM system.

Reference attributes for related stored objects in a multi-tenant cloud service

Embodiments include a multi-tenant cloud system with a first data center and a second remote data center. The first data center authenticates a first client and stores resources that correspond to the first client, and is in communication with the second data center. The second data center authenticates the first client and replicates the resources. The first data center receives a write request for the first client, writes the write request and generates change event messages in a first order. The first data center pushes the change event messages to the second data center via REST API calls. In response to receiving the change event messages, the second data center is configured to write the change event messages in the first order to its local database.

Embodiments operate a multi-tenant cloud system with a first data center. At the first data center, embodiments authenticate a first client and store resources that correspond to the first client, the first data center in communication with a second data center that is configured to authenticate the first client and replicate the resources. In response to upgrading global resources at the first data center to a new version, embodiments generate a manifest file including a listing of global resource types and schemas that are modified or added in response to the upgrading. Embodiments further upgrade global resources based on the manifest file and write the upgraded global resources to a first global database and generate change event messages corresponding to the upgraded global resources.

Replication of resource type and schema metadata for a multi-tenant identity cloud service

A system performs reference attribute query processing in a multi-tenant cloud-based identity and access management (IAM) system by: receiving a request from a client of the multi-tenant cloud-based IAM system, where the request indicates one or more reference attributes associated with a resource that is persisted in a database of the multi-tenant cloud-based IAM system, and the request indicates one or more filter conditions configured to be applied on the one or more reference attributes; building a query based on the one or more reference attributes and the one or more filter conditions; retrieving resource data by executing the query on a database of the multi-tenant cloud-based IAM system, where the retrieved resource data is associated with the one or more reference attributes and satisfies the one or more filter conditions; and returning the retrieved data to the client of the multi-tenant cloud-based IAM system.

Reference attribute query processing for a multi-tenant cloud service

Embodiments replicate resources in a multi-tenant cloud system. Embodiments receive a master resource, associated with a master account of the cloud system to be replicated, where the master resource includes a master JavaScript Object Notation ('JSON') object and includes a plurality of master attributes. Embodiments generate a master resource metadata JSON by calculating hash values for each of the master attributes to generate master attribute level hashes and by calculating an aggregate of all of the hash values to generate a master resource level hash. Embodiments store each master attribute of the master JSON object in a separate column of a master database table associated with the master account and store the master resource metadata JSON is in a separate hash column of the master database table. Embodiments replicate the master JSON object to create a replicated JSON object including a plurality of replicated attributes.

Tenant data comparison for a multi-tenant identity cloud service

A privileged account manager is provided for monitoring privileged sessions on target systems of an enterprise. In an embodiment, the privileged account manager is configured to capture metadata related to a privileged session and generate a first activity pattern for the privileged session based on the captured metadata. The first activity pattern may include a sequence of one or more activities performed by a first user during the privileged session. The privileged account manager may be configured to identify a second activity pattern that comprises at least a subset of the one or more activities performed by the first user during the privileged session and determine an appropriate action to be performed for the first activity pattern based on the identification of the second activity pattern. In some embodiments, the privileged account manager may be configured to transmit the action to a second user on a client device.

Privileged session analytics

A system and method can monitor one or more user sessions on a target system in a computing environment. An account managing system can capture a plurality of user session screen captures that are associated with said one or more user sessions on the target system. Furthermore, the account managing system can compare a user session screen capture, which is captured at a time during said one or more user sessions, with one or more user session screen captures that are recorded before the time. Then, the account managing system can record said user session screen capture if the target system is determined to be active at the time when said user session screen capture is captured.

System and method for optimizing visual session recording for user account management in a computing environment

A system and method can support user account management in a computing environment. The computing environment can include a video encoding pool to support load balancing and a managing server, such as a privileged account manager server. The video encoding pool includes a set of nodes that are able to perform one or more video processing tasks for another node. Furthermore, the managing server can receive a request from a managed node in the computing environment for delegating a video processing task, and can select one or more nodes from the video encoding pool to load balance and to perform the video processing task.

System and method for supporting video processing load balancing for user account management in a computing environment

A system and method can support user account management in a computing environment. A managing server, such as a privileged account manager server, can use an agent to manage a target system in the computing environment. The agent on the target system can initiate a video processing task based on a plurality of user session screens recorded on the target system, wherein the video processing task encodes the plurality of user session screens into a video. Furthermore, the agent can determine whether a resource usage for performing the video processing task on the target system exceeds a threshold. Then, the agent can dynamically offload the video processing task to a managing server that operates to manage the target system, if the resource usage for performing the video processing task on the target system exceeds the threshold.

System and method for supporting dynamic offloading of video processing for user account management in a computing environment

A system and method can support user account management in a computing environment. A user account manager can configure one or more recording policies, wherein said one or more recording policies operates to define detailed information on how user activities on a target system should be recorded. Furthermore, the user account manager can provide said one or more recording policies to one or more visual session recording processes associated with the target system. Then, the user account manager can use said one or more visual session recording processes to record activities in a user session on the target system based on said one or more recording policies.

System and method for using policies to support session recording for user account management in a computing environment

A system and method can support user account management in a computing environment. The computing environment can include a video encoding pool to support load balancing and a managing server, such as a privileged account manager server. The video encoding pool includes a set of nodes that are able to perform one or more video processing tasks for another node. Furthermore, the managing server can receive a request from a managed node in the computing environment for delegating a video processing task, and can select one or more nodes from the video encoding pool to load babalance and to perform the video processing task.

Growing community of inventors

San Jose, CA, United States of America

Sudhir Kumar Srinivasan