Abstract: A multi-tenant identity management (IDM) system enables IDM functions to be performed relative to various different customers' domains within a shared cloud computing environment and without replicating a separate IDM system for each separate domain. The IDM system can provide IDM functionality to service instances located within various different customers' domains while enforcing isolation between those domains. A cloud-wide identity store implemented as a single LDAP directory can contain identity information for multiple customers' domains. This single LDAP directory can store identities for entities for all tenants, in separate partitions or subtrees of the LDAP directory, each such partition or subtree being dedicated to a separate identity domain for a tenant. Components of the cloud computing environment ensure that LDAP entries within a particular subtree are accessible only to service instances that have been deployed to the identity domain that corresponds to that particular subtree.

Abstract: A unified authorization system for an enterprise that includes heterogeneous access control environments is provided. For example, components in the enterprise utilizing either JPS or OAM can both use the unified authorization system to perform authorization. A common policy store can contain policies applicable to diverse components in a canonical form conducive to varieties of access control models. The data model used within the common policy store can support access control features found in both JSP and OAM environments, such as both role-based policies and delegable access control administration. The common policy store can enable the querying and retrieval of authorization policies that are based on various access control models. A single unified administrator interface permits administrators of applications following any kind of access control model to administer policies for resources.

Abstract: An authorization system that conforms to legacy access control models provides mechanisms whereby structures already existing within those legacy access control models can be used to pass additional information to and from that authorization system. Because the authorization system conforms to the legacy model, legacy applications can still interact with the authorization system without modification. Because the authorization system also provides mechanisms whereby the existing structures can be used to pass the additional information or return additional information, more advanced applications can make use of enhanced access control features of the authorization system. Such enhanced features can involve policy-based decisions that take into account the additional information in determining whether to permit resource access. Such enhanced features can involve the placement of policy-specified obligations within the existing structures to be returned back to the advanced applications.

Abstract: A framework is provided for integrating Internet identities in enterprise identity and access management (IAM) infrastructures. A framework is provided for open authorization. A framework is also provided for relying party functionality.

Abstract: An access management system architecture is provided. In one embodiment, the architecture comprises modular and decoupled components, which allow composability of heterogeneous solutions.

Abstract: A method, system, and article of manufacture for querying an implicit hierarchy is disclosed. According to one approach, implicit hierarchies can be queried by accessing the relevant catalog tables for the attribute relevant to the query. Each identified entry in the relevant catalog table is followed through its implied hierarchical chains until all relevant entries have been identified. The catalog table containing the normalized form of the DN for each user can be consulted to identify the entry identifier for each entry corresponding to implicit hierarchy being queried, which can be searched in the appropriate catalog table to search the chain of entries for the implied hierarchy. In an approach, one or more templates may be used to generate a query language statement to perform the query upon the implicit hierarchy.

Abstract: A system, method, computer program and article of manufacture for updateable fan-out replication with reconfigurable master association in a large, multi-node LDAP environment. A replication ring supports the addition of fan-out nodes as children to each primary node that sits on a replication ring. The fan-out nodes can be cascaded in multiple parent/child relationships and can support full replication or a subset of the parent data. Each child/parent relationship is defined by an agreement. Each fan-out node replicates changes to their immediate children and parent based upon the change details and the configured agreement, distributing the replication load.

Abstract: A system, method, computer program and article of manufacture for updateable fan-out replication with reconfigurable master association in a large, multi-node LDAP environment. A replication ring supports the addition of fan-out nodes as children to each primary node that sits on a replication ring. The fan-out nodes can be cascaded in multiple parent/child relationships and can support full replication or a subset of the parent data. Each child/parent relationship is defined by an agreement. Each fan-out node replicates changes to their immediate children and parent based upon the change details and the configured agreement, distributing the replication load.

Abstract: A method and system for representing objects in a relational database is provided. In one aspect, the invention provides a method and system for storing directory information objects in a relational database management system. In addition, a method and system for generating a statement in a database query language to search or manipulate objects or entries that are stored in a relational database is disclosed. An aspect of the invention is directed to a method and system that can automatically generate a SQL statement for an LDAP search filter.

Abstract: A method and system for representing objects in a relational database is provided. In one aspect, the invention provides a method and system for storing directory information objects in a relational database management system. In addition, a method and system for generating a statement in a database query language to search or manipulate objects or entries that are stored in a relational database is disclosed. An aspect of the invention is directed to a method and system that can automatically generate a SQL statement for an LDAP search filter.

Abstract: A method, system, and article of manufacture for querying an implicit hierarchy is disclosed. According to one approach, implicit hierarchies can be queried by accessing the relevant catalog tables for the attribute relevant to the query. Each identified entry in the relevant catalog table is followed through its implied hierarchical chains until all relevant entries have been identified. The catalog table containing the normalized form of the DN for each user can be consulted to identify the entry identifier for each entry corresponding to implicit hierarchy being queried, which can be searched in the appropriate catalog table to search the chain of entries for the implied hierarchy. In an approach, one or more templates may be used to generate a query language statement to perform the query upon the implicit hierarchy.

Abstract: A method and system for representing objects in a relational database is provided. In one aspect, the invention provides a method and system for storing directory information objects in a relational database management system. In addition, a method and system for generating a statement in a database query language to search or manipulate objects or entries that are stored in a relational database is disclosed. An aspect of the invention is directed to a method and system that can automatically generate a SQL statement for an LDAP search filter.

Abstract: A method and mechanism for data replication is disclosed. One embodiment of the invention relates to an efficient and effective replication system using LDAP replication components. Another embodiment of the invention pertains to a schema and format independent method for data replication. Procedures for adding, deleting, and modifying replicated data, and for replicating conflict resolution are also disclosed. A further embodiment of the invention is directed to improved methods and mechanisms for adding and removing nodes from a replication system.

Abstract: A method and system for representing objects in a relational database is provided. In one aspect, the invention provides a method and system for storing directory information objects in a relational database management system. In addition, a method and system for generating a statement in a database query language to search or manipulate objects or entries that are stored in a relational database is disclosed. An aspect of the invention is directed to a method and system that can automatically generate a SQL statement for an LDAP search filter.

Abstract: A method and system for representing objects in a relational database is provided. In one aspect, the invention provides a method and system for storing directory information objects in a relational database management system. In addition, a method and system for generating a statement in a database query language to search or manipulate objects or entries that are stored in a relational database is disclosed. An aspect of the invention is directed to a method and system that can automatically generate a SQL statement for an LDAP search filter.