Abstract: An identity authentication management (IAM) service is established as a master over a master identity database of the centralized identity authentication management service. When adding an additional node to the computing infrastructure, a non-master copy of the master identity database is distributed to the additional node. Ongoing coordination between the master identity database and the non-master copy is established so as to synchronize differences between the master identity database and the non-master copy of the identity database. The additional node hosts a fully-functional authentication management service using the non-master copy of the master identity database and is able to respond to READ requests for data by accessing the non-master copy—without interaction with the centralized identity authentication management service.

Abstract: Methods, systems and computer program products for user-specific curation of applications from heterogeneous application sources. Multiple components are interconnected to perform user-specific curation operations. The user-specific curation operations comprise accessing application metadata corresponding to a plurality of applications from a plurality of application sources. The application sources may be heterogeneous and may be situated at local sites or at remote sites. A set of rules are applied to the application metadata to determine if one or more applications are authorized for use by a particular user or group. Publication attributes that control accessibility by a particular user or particular group of users are associated with the authorized applications. Based on the publication attributes as they apply to a particular user, one or more curated applications are selected from the authorized applications.

Abstract: Examples of services described herein expose an application programming interface (API) which may return the run-time configuration information. In this manner, software external to the service (e.g., an orchestrator) may query the service to determine the run-time configuration information, then provide both the initial configuration information known to the external software and the run-time configuration information to an Internet-facing gateway. Examples described herein may accordingly avoid or reduce instances of an upgrade dependency. When the service is upgraded, the run-time configuration information may be obtained by calling the API without a need to also upgrade the software external to the service.

Abstract: Methods, systems and computer program products for user-specific curation of applications from heterogeneous application sources. Multiple components are interconnected to perform user-specific curation operations. The user-specific curation operations comprise accessing application metadata corresponding to a plurality of applications from a plurality of application sources. The application sources may be heterogeneous and may be situated at local sites or at remote sites. A set of rules are applied to the application metadata to determine if one or more applications are authorized for use by a particular user or group. Publication attributes that control accessibility by a particular user or particular group of users are associated with the authorized applications. Based on the publication attributes as they apply to a particular user, one or more curated applications are selected from the authorized applications.

Abstract: An identity authentication management (IAM) service is established as a master over a master identity database of the centralized identity authentication management service. When adding an additional node to the computing infrastructure, a non-master copy of the master identity database is distributed to the additional node. Ongoing coordination between the master identity database and the non-master copy is established so as to synchronize differences between the master identity database and the non-master copy of the identity database. The additional node hosts a fully-functional authentication management service using the non-master copy of the master identity database and is able to respond to READ requests for data by accessing the non-master copy—without interaction with the centralized identity authentication management service.

Abstract: Methods, systems and computer program products for user-specific curation of applications from heterogeneous application sources. Multiple components are interconnected to perform user-specific curation operations. The user-specific curation operations comprise accessing application metadata corresponding to a plurality of applications from a plurality of application sources. The application sources may be heterogeneous and may be situated at local sites or at remote sites. A set of rules are applied to the application metadata to determine if one or more applications are authorized for use by a particular user or group. Publication attributes that control accessibility by a particular user or particular group of users are associated with the authorized applications. Based on the publication attributes as they apply to a particular user, one or more curated applications are selected from the authorized applications.

Abstract: Systems for computer security. A proxy service implements methods for substituting callback uniform resource locators (URLs) when using an OAuth protocol exchange to authenticate an application. A proxy service is established at a first uniform resource locator to carry out communications between one or more identity access management servers and a plurality of application hosting sites. At least one of the plurality of application hosting sites has a second uniform resource locator that is different from the first uniform resource locator. An identity access management server will register the application and the first uniform resource locator. From any hosting site, the application is invoked, upon which invocation, the application carries out at least a portion of the OAuth protocol exchange with the IAM. The proxy service at the first uniform resource locator receives an authentication message from the IAM and then redirects the authentication message to the application hosting site.

Abstract: A method includes receiving, by a host server on a public cloud including one or more physical data centers associated with one or more logical zones, a pairing request by a client device associated with a private cloud, allocating, by the host server, access to resources on the one or more physical data centers to the client device, and pairing, by the host server, the private cloud to the public cloud based on receiving an identity provider token from an identity provider.

Abstract: Computing cluster system management. Embodiments implement fine-grained rule-based approaches to error recovery. A service dispatches tasks to components of the computing cluster. At the time of task dispatching, entries are made into a write-ahead log. The write-ahead log entries serve for recording task and component attributes. A monitor detects a failure event raised by one or more of the components of the computing cluster. Responses to the failure event include determining a set of conditions that are present in the computing cluster at the time of the detection, and then using the failure event and the determined conditions in combination with a set of fine-grained failure processing rules to determine one or more recovery actions to take. Recovery actions include redistributing the failed task to a different node or to different service. Certain conditions and rules initiate actions that rollback the state of a component to a previous success point.

Abstract: Systems and methods for managing communication between applications (e.g., apps) in a host computing environment. Apps are published to a globally-accessible site. Upon download of an app to a host computing environment, apps can register themselves with a communication gateway as being discoverable and permissive to inter-app communications. Message queues are created to facilitate asynchronous communications between apps. After registration, any of the apps can send and receive messages using the communication gateway. The messages can be directed to any other app that is registered with the communication gateway. Using the message queues, the communication gateway facilitates asynchronous app interactions such that any app can communicate with any other discoverable and permissive app. Aspects of operation, discoverability and other attributes can be codified in an application manifest that is processed by the communication gateway.

Abstract: Examples of services described herein expose an application programming interface (API) which may return the run-time configuration information. In this manner, software external to the service (e.g., an orchestrator) may query the service to determine the run-time configuration information, then provide both the initial configuration information known to the external software and the run-time configuration information to an Internet-facing gateway. Examples described herein may accordingly avoid or reduce instances of an upgrade dependency. When the service is upgraded, the run-time configuration information may be obtained by calling the API without a need to also upgrade the software external to the service.

Abstract: Systems for distributed data storage. A user accesses a user interface in a distributed virtualization system comprising computing nodes that support virtualized controllers that include preconfigured APIs to receive application extension modules. The system receives a user command from a user interface at the virtualized controller, the user command corresponding to a download request for at least one application extension. A successful download and integration event causes integration of the containerized application extension into the system. The additional functionality of the containerized application extension is offered to the user. The user can address additional functionality of the containerized application extension through a user interface.

Abstract: A method includes receiving, by a host server on a public cloud including one or more physical data centers associated with one or more logical zones, a pairing request by a client device associated with a private cloud, allocating, by the host server, access to resources on the one or more physical data centers to the client device, and pairing, by the host server, the private cloud to the public cloud based on receiving an identity provider token from an identity provider.

Abstract: High-performance web service communication techniques. Embodiments manage communications between a client and web services that are accessible over a network. Communications between the client and web services comprise web service calls. A client forms a batch message comprising a plurality of target web service calls directed to target web services that are identifiable by the target web service calls. A middleware component or batch processor intercepts the batch message and generates a set of individual web service calls that are derived from the contents of the batch message. Each of the set of individual service calls that are derived from the batch message are dispatched to the target web services in accordance with a set of web service call prioritization and formatting rules. Batch formation and decomposition into individual service messages is performed such that neither the target web services nor their respective invoking call formats require modification.

Abstract: High-performance web service communication techniques. Embodiments manage communications between a client and web services that are accessible over a network. Communications between the client and web services comprise web service calls. A client forms a batch message comprising a plurality of target web service calls directed to target web services that are identifiable by the target web service calls. A middleware component or batch processor intercepts the batch message and generates a set of individual web service calls that are derived from the contents of the batch message. Each of the set of individual service calls that are derived from the batch message are dispatched to the target web services in accordance with a set of web service call prioritization and formatting rules. Batch formation and decomposition into individual service messages is performed such that neither the target web services nor their respective invoking call formats require modification.

Abstract: Systems for distributed data storage. A user accesses a user interface in a distributed virtualization system comprising computing nodes that support virtualized controllers that include preconfigured APIs to receive application extension modules. The system receives a user command from a user interface at the virtualized controller, the user command corresponding to a download request for at least one application extension. A successful download and integration event causes integration of the containerized application extension into the system. The additional functionality of the containerized application extension is offered to the user. The user can address additional functionality of the containerized application extension through a user interface.

Abstract: Systems and methods for computer security in computer clusters. Techniques provide secure user access to applications that run in shared resource computing environments. A method embodiment commences upon identifying an application digital certificate corresponding to a subject application. The subject application is stored for access by a reverse proxy authorization service that also runs in the shared computing environment. Individual user processes are uniquely identified by corresponding user credentials. The reverse proxy authorization service processes a request to access the subject application, whereupon a generated subject application instance specific to the requestor is installed. Installation includes authentication using the application digital certificate for the subject application and authorization using the requestor's credentials.

Abstract: Computing cluster system management. Embodiments implement fine-grained rule-based approaches to error recovery. A service dispatches tasks to components of the computing cluster. At the time of task dispatching, entries are made into a write-ahead log. The write-ahead log entries serve for recording task and component attributes. A monitor detects a failure event raised by one or more of the components of the computing cluster. Responses to the failure event include determining a set of conditions that are present in the computing cluster at the time of the detection, and then using the failure event and the determined conditions in combination with a set of fine-grained failure processing rules to determine one or more recovery actions to take. Recovery actions include redistributing the failed task to a different node or to different service. Certain conditions and rules initiate actions that rollback the state of a component to a previous success points.

Abstract: Systems and methods for managing communication between applications (e.g., apps) in a host computing environment. Apps are published to a globally-accessible site. Upon download of an app to a host computing environment, apps can register themselves with a communication gateway as being discoverable and permissive to inter-app communications. Message queues are created to facilitate asynchronous communications between apps. After registration, any of the apps can send and receive messages using the communication gateway. The messages can be directed to any other app that is registered with the communication gateway. Using the message queues, the communication gateway facilitates asynchronous app interactions such that any app can communicate with any other discoverable and permissive app. Aspects of operation, discoverability and other attributes can be codified in an application manifest that is processed by the communication gateway.