Bmc Software, Inc.

Emc IP Holding Company LLC

Vitaly Morozov

Michael Roche

Michal Jacek Drozd

Aliaksandr Shtop

Ilia Fischer

Eric Humphrey

Eric Humphery

A system for reconciling object for a configuration management databases employs statistical rules to reduce the amount of manual identification required by conventional reconciliation techniques. As users manually identify matches between source and target datasets, statistical rules are developed based on the criteria used for matching. Those statistical rules are then used for future matching. A threshold value is adjusted as the statistical rules are used, incrementing the threshold value when the rule successfully matches source and target objects. If the threshold value exceeds a predetermined acceptance value, the system may automatically accept a match made by a statistical rule. Otherwise, suggestions of possibly applicable rules may be presented to a user, who may use the suggested rules to match objects, causing adjustment of the threshold value associated with the suggested rules used.

Statistical identification of instances during reconciliation process

An enhanced resource reconciliation process is disclosed to examine the metadata hierarchy of unidentified instances of configuration objects within a particular 'data partition' (sometimes called a dataset) of an enterprise configuration management database (CMDB) and perform reconciliation against a target dataset, such as a golden, i.e., production, dataset. The enhanced reconciliation process could identify against instances in the production dataset that are of the same class as the unidentified instance&#x2014;as well as instances that come from any 'candidate' classes. Candidate classes could consist of, e.g., classes upstream or downstream from the unidentified instance in the metadata hierarchy. By allowing the specification of one or more reconciliation properties, such as, &#x201c;identify downstream,&#x201d; &#x201c;identify upstream,&#x201d; &#x201c;identify upstream and downstream,&#x201d; or &#x201c;identify resources of the same class only,&#x201d; the enhanced resource reconciliation process could perform identification and resource reconciliation against instances of any class in the unidentified instance's metadata hierarchy.

Method of reconciling resources in the metadata hierarchy

A user is authenticated based on user credentials obtained from a request in response to the request received from a client device. A plurality of tenants is identified in which the user is a member and, for each of the tenants associated with the user, one or more roles of the user are determined within the tenant. For each of the one or more roles, one or more privileges the user is entitled within a capacity of the role are determined. An authorization token is generated based on information identifying the tenants associated with the user, one or more roles of the user within each tenant, and one or more privileges associated with each role. The authorization token is transmitted to the client device to allow the client device to determine whether the user is authenticated and allowed to access the resource of a particular tenant.

Principal/user operation in the context of a tenant infrastructure

A first request is received from a first user to revoke an access right of a second user of a first tenant for accessing data of a second tenant, where the first tenant is a parent tenant of the second tenant. In one embodiment, in response to the first request, a first role of the first user within the second tenant and a second role of the first user within the first tenant are determined. A first and second access privileges of the first role and second role of the first user, respectively, are determined to allow the first user to revoke the access right to the second tenant. In response to the first user having a revoke privilege in the first and second tenant, the first user is allowed to remove the second tenant from the first tenant.

Child tenant revocation in a multiple tenant environment

In response to a request received from a client device, the user is authenticated based on user credentials extracted from the request. Upon having successfully authenticated the user, tenants and one or more roles of each of the tenants associated with the user are identified. In one embodiment, an authorization token having information identifying the plurality of tenants and their respective one or more roles of the user is generated. The information of each of the tenants and its respective roles are encrypted with a specific key corresponding to the tenant. The authorization token containing the encrypted tenants and the roles of the user is transmitted to the client device to allow the client device to determine whether the user is allowed to access a requested resource based on the authorization token.

SAML representation for multi-tenancy environments

A management system may include a reconciliation engine configured to reconcile a first instance of a resource object from a first data provider and a second instance of the resource object from a second data provider to obtain a reconciled resource object, and store the first instance, and second instance, and the reconciled resource object in datasets. The management system may include a context sensitive query engine configured to receive a context-sensitive query including context information identifying a source originally providing context sensitive data associated with a context-sensitive attribute, and retrieve the context sensitive data from one or more of the datasets based on the context information.

Growing community of inventors

Irvine, CA, United States of America

Vitaly Morozov