Oracle International Corporation

Uppili Srinivasan

Reza M B'Far

Ryan Golden

Alan Waxman

Ajay Sondhi

Ching-Wen Chu

Yasin Cengiz

Tsai-Ming Tseng

Venkata S Evani

Vasukiammaiyar Asokkumar

Nigel Jacobs

Harpinder Madan

Beomsuk Kim

Sirish V Vepa

Vrinda S Joshi

Sreedhar Chitullapally

Mike Adourian

Siddharth Sinha

Hari Vn Sastry

Sanjay Jain

Brian Daniel Gustafson

Shivaram Bhat

Vamsi Motukuru

Kuang-Yu Shih

Saurabh Shrivastava

Amit Sharma

Satishkumar Venkatasamy

Daniel Shih

Joseph Mazur

Ramana Rao S Turlapati

Quan Zhou

A multi-tenant identity management (IDM) system enables IDM functions to be performed relative to various different customers' domains within a shared cloud computing environment and without replicating a separate IDM system for each separate domain. The IDM system can provide IDM functionality to service instances located within various different customers' domains while enforcing isolation between those domains. A cloud-wide identity store can contain identity information for multiple customers' domains, and a cloud-wide policy store can contain security policy information for multiple customers' domains. The multi-tenant IDM system can provide a delegation model in which a domain administrator can be appointed for each domain, and in which each domain administrator can delegate certain roles to other user identities belong to his domain. Service instance-specific administrators can be appointed by a domain administrator to administer to specific service instances within a domain.

Multi-tenancy identity management system

Techniques, including systems are methods, for analyzing data from multiple sources are disclosed and suggested herein. In an embodiment, information from one or more information sources is received. The received information is stored in one or more data stores that collectively implement one or more ontologies. One or more conditions are applied to the information in the one or more data stores to determine a conclusion.

Techniques for analyzing data from multiple sources

Techniques for enforcing policies. A set of data is stored in one or more data stores. A plurality of semantic concepts for an ontology are defined and a map is constructed from the set of data to the concepts. The map is executed in order to transform data from the set of data to a second set of data. The second set of data is stored according to the ontology. The second set of data is reasoned in order to determine compliance with one or more policies.

Techniques for extracting semantic data stores

A framework, which conforms to the OAuth standard, involves a generic OAuth authorization server that can be used by multiple resource servers in order to ensure that access to resources stored on those resource servers is limited to access to which the resource owner consents. Each resource server registers, with the OAuth authorization server, metadata for that resource server, indicating scopes that are recognized by the resource server. The OAuth authorization server refers to this metadata when requesting consent from a resource owner on behalf of a client application, so that the consent will be of an appropriate scope. The OAuth authorization server refers to this metadata when constructing an access token to provide to the client application for use in accessing the resources on the resource server. The OAuth authorization server uses this metadata to map issued access tokens to the scopes to which those access tokens grant access.

Pluggable authorization policies

Techniques for implementing policies. In an embodiment, first data is stored in a first data store according to a first schema. A second schema is defined based at least in part on a policy and an ontology. Second data, which includes at least a portion of the first data, is stored in a second data store according to the second schema. Storing the second data is based at least in part on a mapping of the first schema to the second schema. At least a portion of the second data is analyzed and results of the analysis are provided to a user.

Generic ontology based semantic business policy engine

Multiple resource servers interacting with single OAuth server

A multi-tenant identity management (IDM) system enables IDM functions to be performed relative to various different customers' domains within a shared cloud computing environment and without replicating a separate IDM system for each separate domain. The IDM system can provide IDM functionality to service instances located within various different customers' domains while enforcing isolation between those domains. A cloud-wide identity store implemented as a single LDAP directory can contain identity information for multiple customers' domains. This single LDAP directory can store identities for entities for all tenants, in separate partitions or subtrees of the LDAP directory, each such partition or subtree being dedicated to a separate identity domain for a tenant. Components of the cloud computing environment ensure that LDAP entries within a particular subtree are accessible only to service instances that have been deployed to the identity domain that corresponds to that particular subtree.

LDAP-based multi-tenant in-cloud identity management system

A unified authorization system for an enterprise that includes heterogeneous access control environments is provided. Components in the enterprise utilizing either Java Platform Security (JPS) or Oracle Access Manager (OAM) can both use the unified authorization system to perform authorization. A common policy store can contain policies applicable to diverse components in a canonical form conducive to varieties of access control models. The data model used within the common policy store can support access control features found in both role-based policies and delegable access control administration. The common policy store can enable the querying and retrieval of authorization policies that are based on various access control models. A unified administrator interface permits administrators of applications following any kind of access control model to administer policies for resources. A unified policy decision engine can evaluate whether authorization policies are satisfied, regardless of the access control models that those policies follow.

Authorization system for heterogeneous enterprise environments

An authorization system that conforms to legacy access control models provides mechanisms whereby structures already existing within those legacy access control models can be used to pass additional information to and from that authorization system. Legacy applications can still interact with the authorization system without modification. Because the authorization system also provides mechanisms whereby the existing structures can be used to pass the additional information or return additional information, more advanced applications can make use of enhanced access control features of the authorization system. Such enhanced features can involve policy-based decisions that take into account the additional information in determining whether to permit resource access. Such enhanced features can involve the placement of policy-specified obligations within the existing structures to be returned back to the advanced applications. Such obligations can indicate requirements that those applications need to fulfill in conjunction with performing operations on resources.

Obligation system for enterprise environments

An access management system architecture is provided. In one embodiment, the architecture comprises modular and decoupled components, which allow composability of heterogeneous solutions.

Access management architecture

Techniques, including systems are methods, for analyzing data from multiple sources are disclosed and suggested herein. In an embodiment, external information from one or more external information sources and internal information from one or more internal information sources is received. The received external information and internal information are stored in one or more data stores that collectively implement one or more ontologies. One or more conditions are applied to the external information and internal information in the one or more data stores to determine a conclusion and the conclusion is provided to a user.

A method, system, and article of manufacture for querying an implicit hierarchy is disclosed. According to one approach, implicit hierarchies can be queried by accessing the relevant catalog tables for the attribute relevant to the query. Each identified entry in the relevant catalog table is followed through its implied hierarchical chains until all relevant entries have been identified. The catalog table containing the normalized form of the DN for each user can be consulted to identify the entry identifier for each entry corresponding to implicit hierarchy being queried, which can be searched in the appropriate catalog table to search the chain of entries for the implied hierarchy. In an approach, one or more templates may be used to generate a query language statement to perform the query upon the implicit hierarchy.

Growing community of inventors

Fremont, CA, United States of America

Uppili Srinivasan