Oracle International Corporation

Thomas B Remahl

Joan C Teng

Andy Tsang

Richard Sinn

Sachin Agarwal

Chi-Cheng Lee

Bob Summers

Andy M Tsang

Technology is disclosed for using workflows based on domains in a hierarchical data structure (e.g. LDAP directory) or other type of data structure. When a workflow is created, it is associated with domain. The domain is defined by a selected node and all nodes below that selected node in the hierarchical data structure. At run time, the system identifies which workflows perform a requested task and are associated with a domain that includes the target of the task. If multiple workflows are determined, the user is provided with the ability to choose one of the identified workflows for performing the tasks.

Domain based workflows

An Identity System manages certificate related actions for organization members and affiliates. Examples of certificate related actions include certificate enrollment, renewal, and revocation. The Identity System maintains and employs different certificate related workflows for different organization members and affiliates. After receiving a request for a certificate related action, the Identity System retrieves a workflow for responding to the request. The Identity System selects the workflow from a plurality of workflows for responding to the type of certificate related action being requested. Each workflow in the plurality corresponds to a different set of user characteristics. The Identity System selects the workflow that corresponds to the requested certificate related action, as well as the type of user for which the request is made.

Employing electronic certificate workflows

Workflows are used to automate processes. When a first workflow is performed, it may invoke a set of one or more nested workflows, workflows in other applications or services in other applications. The first workflow can be configured to pause and wait for the invoked set of one or more nested workflows, workflows in other applications, or services in other applications. Alternatively, the first workflow can be configured to proceed without waiting. Various means are disclosed for re-staring the first workflow and providing data back for the first workflow.

Workflows with associated processes

Technology is disclosed for supporting multiple data stores. The set of data stores can be of a uniform type, or the various data stores can be different types (e.g. Lightweight Directory Access Protocol (LDAP), Structured Query Language (SQL), etc.). One implementation of the disclosed technology is with an Identity System. Another implementation is with an integrated Identity System and Access System. Various embodiments of the present invention utilize different means to separate the business logic of a system from the data access logic so that different types of data stores can be used without changing the business logic.

Support for multiple data stores

Systems and methods are provided for multi-language support through the management of multi-valued attributes. A data store maintains multi-valued attributes having language components and value components. The value components specify language specific values for the attributes and can be associated with corresponding language components. A server in communication with the data store can provide outputs to requesting users in accordance with a preferred language. For example, a request to access an identity profile maintained by an Identity System can be fulfilled by constructing a page or other output including the requested profile data. An Identity Server can construct the output to include attribute values corresponding to the preferred language associated with the request. Attribute configuration data can similarly be maintained with language components and value components. The configuration of an attribute such as its display name can be included in an output in accordance with a preferred language.

Multi-language support for enterprise identity and access management

Data is acquired for an Identity System based on a one or more rules. The data can be from the same Identity System Component, another Identity System Component or a component external to the Identity System. The acquired data can be used to populate an Identity Profile, configure a workflow, or provide information to any other object, process, component, etc. of the Identity System. In one embodiment, the present invention combines dynamic identity value substitution and directory filter rules to enable rule based identity management. It enables dynamic population of identity data and real-time routing for identity management workflows. In other embodiments, the present invention can be applied to systems other than Identity Systems.

Rule based data management

Technology is disclosed for limiting the number of central data store accesses required when performing a series of steps, such as a workflow. A local data store is coupled between a central data store and a system carrying out a workflow. Alternatively, a Transfer Engine is coupled between the local data store and the central data store to transfer data between the local data store and central data store. The Transfer Engine allows the data formats in the central data store and local data store to be independent of each other. During a workflow step, the system stores attributes related to the workflow in the local data store&#x2014;updating modified attribute values and creating entries for newly added attributes. The system determines whether any attributes in the central data store need to be updated with attribute information from the local data store. The system only updates the central data store with local data store attribute values for new and modified attributes when necessary&#x2014;avoiding central data store updates after every workflow step.

Growing community of inventors

Los Altos, CA, United States of America

Thomas B Remahl