Abstract: An identity management and authorization system (IMAS) receives a request to download an application to a user device associated with a user. The IMAS downloads, to the user device, a template application instance corresponding to the requested application, the template application instance having a reduced functionality than the requested application. The IMAS receives, from the user device, a request to register to the downloaded template.

Abstract: Described herein is a framework for generating an integrated identity and access management (IAM) system from a first IAM system and a second IAM system that is different than the first IAM system. The integrated IAM system is generated by: (i) creating a domain in a customer tenancy associated with the first IAM system, and (ii) embedding an identity provider of the second IAM system within the domain. The integrated IAM system receives a request from a user to perform an operation with respect to resource associated with the second IAM system. Upon the user being successfully authenticated by the integrated IAM system, the request is executed.

Abstract: Techniques are provided for granting an application of a first type of identity system, which uses a first type of identity token, access to a second type of identity system, which uses a second type of identity token. An application can make a request to a token exchange system. The request can include a bearer token and a public key of the application. The token exchange system can exchange the bearer token for a Proof-of-Possession token after performing verification steps. A token exchange system can exchange the first token (e.g., bearer token) for the first identity system for the second token (e.g., Proof-of-Possession token) for the second identity system without requiring entry of credentials to access the second identity system.

Abstract: Systems and methods for combined authorization for entities within a domain are described. One aspect relates to a method. The method can include receiving a request for a user to take an action in a first system and determining a first authorization status of the action by the user with the first system. The method can include determining a second authorization status of the action by the user with a second system, determining a union of the first authorization status and the second authorization status, and comparing the union of the first authorization status and the second authorization status to authorization criteria.

Abstract: A method and apparatus in a data processing system for managing distribution of data structures. A first data structure is received including a first version identifier. The version identifier is stored for the first data structure. A second structure is received including a second version identifier. Responsive to receiving a second data structure, a determination is made as to whether the second data structure is a replacement for the first data structure. Responsive to the second data structure being a replacement for the first data structure, a determination is made as to whether the first version identifier is different from the second version identifier. Responsive to a determination that the first version identifier is different from the second version identifier, the first data structure is replaced with the second data structure.