Abstract: One embodiment of the present invention provides a system that associates a digital certificate with an enterprise profile. During operation, an identity store receives a digital certificate from a client. Next, the identity store searches for a mapping rule which determines if an enterprise profile is associated with the digital certificate, wherein the enterprise profile facilitates in identifying user capabilities. If a mapping rule is found, the identity store executes the mapping rule to determine if an enterprise profile is associated with the digital certificate. If so, the enterprise profile, which is associated with the digital certificate, is returned to the client.

Abstract: A centralized enterprise security and provisioning policy framework is described. Enterprise wide security and provisioning is stored in a hierarchical fashion in a centralized LDAP based Directory server. Each policy and user maps directly to a unique entry in the directory. Policy entries can be created at specific administrative points in the Directory Information Tree instead of having to duplicate these policies as attributes of every user entry in the directory. The policies can be classified into provisioning, authentication, and authorization policies.

Abstract: A system and method for authenticating users against an external directory service. A client device issues an LDAP (Lightweight Directory Access Protocol) request (e.g., a login request) to a local or native directory server (e.g., an Oracle Internet Directory server) configured to authenticate users for access to a resource (e.g., an Oracle database, an Oracle application server). The native directory server does not maintain or synchronize user passwords, and forwards the request (or details of the request) to a plug-in residing in the resource. The plug-in forwards or issues the request to an external or third-party directory server or service, which attempts to authenticate the user and returns a result indicating success or failure. The plug-in returns the result to the local server, which responds to the client.

Abstract: Embodiments of the invention provide a trust framework for governing service-to-service interactions. This trust framework can provide enhanced security and/or manageability over prior systems. Merely by way of example, in some cases, an information store can be used to store information security information (such as trust information, credentials, etc.) for a variety of services across an enterprise. In other cases, the trust framework can provide authentication policies to define and/or control authentication between services (such as, for example, types of authentication credentials and/or protocols are required to access a particular service—either as a user and/or as another service—and/or types of authentication credentials and/or protocols a service may be enabled to use to access another service). Alternatively and/or additionally, the trust framework can provide authorization policies to define and/or control authorization between services.