Workflows with associated processes

• US 7,937,655 B2
• Filed: 11/30/2001
• Issued: 05/03/2011
• Est. Priority Date: 12/22/2000
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Teng, Joan C., Remahl, Thomas B.
• Primary Examiner(s): HUYNH, THU V
• Application Number:
  US09/999,074
• Publication Number:
  US 20020138543A1
• Time in Patent Office: 3,441 Days
• Field of Search: 715/530, 715/255, 715/229, 718/102, 717/100, 717/101, 717/102, 705 7- 9, 707/200, 707 7- 10, 707/609, 707/733, 707/734
• US Class Current: 715/255
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/5682 Policies or rules for updating, deleting or replacing the stored data
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

Workflows are used to automate processes. When a first workflow is performed, it may invoke a set of one or more nested workflows, workflows in other applications or services in other applications. The first workflow can be configured to pause and wait for the invoked set of one or more nested workflows, workflows in other applications, or services in other applications. Alternatively, the first workflow can be configured to proceed without waiting. Various means are disclosed for re-staring the first workflow and providing data back for the first workflow.

Claims

1. In an identity system, a method for using workflows to manage an identity profile, said method comprising:

receiving, at said identity system, a request for an action that requires the use of a workflow and that pertains to at least one target identity profile of an entity in the identity system, wherein the target identity profile is included in a group of identity profiles;

identifying a first workflow that performs the action and is associated with the target identity profile, wherein the first workflow is a workflow for which a user issuing the request to perform the action is authorized;

initiating, in response to receiving the request and identifying the first workflow, the first workflow at said identity system;

performing, as part of said first workflow, a first task at said identity system to modify an identity profile for one or more users, said identity profile comprising information for determining a set of access rights specifying whether said one or more users can access a resource on a computer;

starting a second workflow as a subflow of said first workflow, according with custom function provided by a third party system external to the identify system, wherein the function responses to an associated event in an event catalog comprising pre and post events, and the starting of the second workflow includes providing a callback command that is used to restart said first workflow;

performing, as part of said second workflow, a second task pertaining to said identity profile;

wherein, said first workflow is performed by a first software application and said second workflow is performed by a second software application;

accessing an indication that said first workflow should wait for said second workflow to complete said second task, wherein said indication is a result code indicating that said first workflow should pause, wherein the pause includes waiting to invoke said first workflow until said callback command is invoked; and

waiting for said second workflow to complete said second task then invoke the callback command to restart said first workflow.

2. A method according to claim 1, wherein:

said indication is a flag indicating that a particular step should wait for a subflow of a previous step.

3. A method according to claim 1, wherein said step of starting a second workflow comprises:

determining that a particular step of said first workflow includes a supplied variable;

searching for one or more workflows that can provide said supplied variable;

identifying said second workflow as a result of said step of searching; and

initiating said second workflow.

4. A method according to claim 3, further comprising:

defining said first workflow, including indicating that said particular step of said first workflow includes said supplied variable.

5. A method according to claim 1, wherein said step of starting a second workflow comprises:

determining that a current step of said first workflow includes a supplied variable;

searching for one or more workflows that can provide said supplied variable;

identifying a set of workflows as a result of said step of searching, said a set of workflows includes said second workflow;

receiving a choice of said second workflow; and

initiating said second workflow.

6. A method according to claim 1, further comprising:

starting one or more additional nested workflows as subflows of said second workflow.

7. A method according to claim 6, wherein said step of starting one or more additional nested workflows comprises

starting a third workflow as a subflow of said second workflow.

8. A method according to claim 7, wherein said step of starting one or more additional nested workflows further comprises:

starting a fourth workflow as a subflow of said third workflow.

9. A method according to claim 7, wherein said step of starting a third workflow comprises:

determining that a particular step of said second workflow includes a supplied variable;

searching for one or more workflows that can provide said supplied variable;

identifying said third workflow as a result of said step of searching; and

initiating said third workflow.

10. A method according to claim 1, further comprising:

reporting a result of said second workflow to said first workflow, if said first workflow is active; and

reporting said result of said second workflow to said identity profile, if said first workflow is not active.

11. A method according to claim 1, wherein:

said callback command includes a callback URL.

12. A method according to claim 1, wherein said step of starting a second workflow comprises:

checking the event catalog to determine whether a particular event of said first workflow is identified in said event catalog; and

invoking a process listed in said event catalog as being associated with said particular event of said first workflow, said process includes initiating said second workflow.

13. A method according to claim 1, further comprising:

reporting a result of said second workflow to said first workflow, if said first workflow is active; and

reporting said result of said second workflow to an identity profile, if said first workflow is not active.

14. A method according to claim 1, further comprising:

using said identity profile to grant access to resources across multiple web servers from a single web-based authentication.

15. A method according to claim 1, wherein said first task to modify an identity profile comprises a task selected from the group consisting:

of creating an identity profile, deleting an identity profile, and modifying one or more attributes of an identity profile.

16. A method according to claim 1, wherein said first task creates a new identity profile for a new user and adds said new identity profile to a directory, and wherein said second task comprises supplying a value for a variable in said new identity profile.

17. A method according to claim 16, further comprising:

searching said identity system to identify a workflow that can supply said value for said variable, wherein starting a second workflow comprises starting said identified workflow.

18. A method according to claim 1, wherein said first task creates a new user and said second task adds said new user to a group.

19. A method according to claim 1, wherein receiving a request comprises an external system triggering the workflow.

20. A method according to claim 1, wherein receiving a request comprises receiving a request from a user.

21. A method according to claim 20, further comprising:

determining whether said user is allowed to initiate said first workflow.

22. A method according to claim 21, wherein initiating a first workflow comprises:

reporting to said user a set of one or more workflows that said first user is allowed to initiate, each of said one or more workflows being configured to perform said action, said set of one or more workflows comprising said first workflow; and

receiving, from said user, a selection of said first workflow for performing said action.

23. The method of claim 1, wherein the group that includes the target identity profile includes one or more groups to which the target identity profile is a static member.

24. The method of claim 23, wherein the target identity profile is identified as a static member of the one or more groups based on a group identity profile for each of the one or more groups.

25. The method of claim 24, wherein the groups that include the target identity profile include one or more groups to which the target identity profile is a dynamic member.

26. The method of claim 25, wherein the target identity profile is identified as a dynamic member of the one or more groups based on application of a rule defined by the group identity profile for each of the one or more groups.

27. The method of claim 26, wherein the group that include the target identity profile includes one or more groups to which the target identity profile is a nested member.

28. The method of claim 27, wherein the target identity profile is identified as a dynamic member of the one or more groups based on the combined set of one or more groups to which the target identity profile is a static member and the one or more groups to which the target identity profile is a dynamic member.

29. In an identity system, a method for using workflows to manage an identity profile, said method comprising:

receiving, at an identity system, a request from a first user to perform an action that modifies an identity profile for a second one or more users, said identity profile comprising information for determining a set of access rights specifying whether said one or more users can access a resource on a computer, wherein the request pertains to at least one target identity profile of an entity in the identity system, and the target identity profile is included in a group of identity profiles;

reporting to said first user a set of one or more workflows that said first user is allowed to initiate, each of said one or more workflows being configured to perform said action;

receiving, from said user, a selection of a first workflow for performing said action;

performing said first workflow in a first software application, said first workflow modifying said identity profile;

causing a second process in a second software application to be performed in response to said first workflow;

starting a second workflow as a subflow of said first workflow according with custom function provided by a third party system external to the identify system, wherein the function responses to an associated event in an event catalog comprising pre and post events, and the starting of the second workflow includes providing a callback command that is used to restart said first workflow;

performing, as part of said second workflow, a second task pertaining to said identity profile;

wherein, said first workflow is performed by a first software application and said second workflow is performed by a second software application;

accessing an indication that said first workflow should wait for said second workflow to complete said second task, wherein said indication is a result code indicating that said first workflow should pause, wherein the pause includes waiting to invoke said first workflow until said callback command is invoked; and

waiting for said second workflow to complete said second task then invoke the callback command to restart said first workflow.

30. A method according to claim 29, wherein:

said second process is a second workflow.

31. A method according to claim 30, wherein:

said first software application is a User Manager;

said second software application is a Group Manager;

said first workflows adds a new user to a directory; and

said second workflow adds said new user to one or more groups.

32. A method according to claim 29, wherein said step of causing comprises:

checking the event catalog to determine whether a particular event of said first workflow is identified in said event catalog; and

invoking a program listed in said event catalog as being associated with said particular event of said first workflow, said program sends a request to said second software application to invoke said second process.

33. A method according to claim 32, wherein:

said invoking a program includes passing one or more attributes of said identity profile to said program.

34. A method according to claim 32, wherein:

said invoking a program includes passing a distinguished name for said identity profile to said program.

35. A method according to claim 32, wherein:

said program creates and send an XML document to said second software application, said XML document includes said request to said second software application to invoke said second process.

36. A method according to claim 32, wherein:

said second process is a second workflow.

37. A method according to claim 32, further comprising:

receiving an output XML document from said second software application, said output XML document is received by said program and includes an output message from said second software application.

38. A method according to claim 32, wherein:

said program reads a configuration file and determines to invoke said second process based on said configuration file, said second process is a second workflow.

39. One or more non-transitory readable storage devices having processor readable code embodied on said processor readable storage devices, said processor readable code for programming one or more processors, said processor readable code comprising:

code for receiving a request for an action that requires the use of a workflow and that pertains to at least one target identity profile of an entity in the identity system, wherein the target identity profile is included in a group of identity profiles;

code for identifying a first workflow that performs the action and is associated with the target identity profile, wherein the first workflow is a workflow for which a user issuing the request to perform the action is authorized;

code for initiating, in response to receiving the request and identifying the first workflow, the first workflow at said identity system;

code for performing, as part of said first workflow, a first task to modify an identity profile for one or more users, said identity profile comprising information for determining a set of access rights specifying whether said one or more users can access a resource on a computer;

code for starting a second workflow as a subflow of said first workflow according with custom function provided by a third party system external to the identify system, wherein the function responses to an associated event in an event catalog comprising pre and post events, and the starting of the second workflow includes providing a callback command that is used to restart said first workflow;

code for performing, as part of said second workflow, a second task pertaining to said identity profile;

wherein, said first workflow is performed by a first software application and said second workflow is performed by a second software application;

code for accessing an indication that said first workflow should wait for said second workflow to complete said second task, wherein said indication is a result code indicating that said first workflow should pause, wherein the pause includes waiting to invoke said first workflow until said callback command is invoked; and

code for waiting for said second workflow to complete said second task then invoke the callback command to restart said first workflow.

40. One or more non-transitory readable storage devices according to claim 39, wherein code for starting a second workflow comprises:

code for checking the event catalog to determine whether a particular event of said first workflow is identified in said event catalog; and

code for invoking a process listed in said event catalog as being associated with said particular event of said first workflow, said process includes initiating said second workflow.

41. One or more non-transitory readable storage devices according to claim 39, wherein said code for starting a second workflow comprises:

code for determining that a particular step of said first workflow includes a supplied variable;

code for searching for one or more workflows that can provide said supplied variable;

code for identifying said second workflow as a result of said step of searching; and

code for initiating said second workflow.

42. One or more non-transitory readable storage devices according to claim 39, wherein said processor readable code further comprises:

code for starting one or more additional nested workflows as subflows of said second workflow.

43. One or more non-transitory readable storage devices according to claim 42, wherein said code for starting a second workflow comprises:

code for determining that a particular step of said first workflow includes a supplied variable;

code for searching for one or more workflows that can provide said supplied variable;

code for identifying said second workflow as a result of said step of searching; and

code for initiating said second workflow.

44. One or more non-transitory readable storage devices according to claim 42, wherein said processor readable code further comprises:

code for reporting a result of said second workflow to said first workflow, if said first workflow is active; and

code for reporting said result of said second workflow to said identity profile, if said first workflow is not active.

45. One or more non-transitory readable storage devices having processor readable code embodied on said processor readable storage devices, said processor readable code for programming one or more processors, said processor readable code comprising:

code for receiving, at an identity system, a request from a first user to perform an action that modifies an identity profile for a second one or more users, said identity profile comprising information for determining a set of access rights specifying whether said one or more users can access a resource on a computer, wherein the request pertains to at least one target identity profile of an entity in the identity system, and the target identity profile is included in a group of identity profiles;

code for reporting to said first user a set of one or more workflows that said first user is allowed to initiate, each of said one or more workflows being configured to perform said action;

code for receiving, from said user, a selection of a first workflow for performing said action;

code for performing said first workflow in a first software application, said first workflow modifying said identity profile;

code for causing a second process in a second software application to be performed in response to said first workflow;

code for starting a second workflow as a subflow of said first workflow according with custom function provided by a third party system external to the identify system, wherein the function responses to an associated event in an event catalog comprising pre and post events, and the starting of the second workflow includes providing a callback command that is used to restart said first workflow;

code for performing, as part of said second workflow, a second task pertaining to said identity profile;

wherein, said first workflow is performed by a first software application and said second workflow is performed by a second software application;

code for accessing an indication that said first workflow should wait for said second workflow to complete said second task, wherein said indication is a result code indicating that said first workflow should pause, wherein the pause include waiting to invoke said first workflow until said callback command is invoked; and

code for waiting for said second workflow to complete said second task then invoke the callback command to restart said first workflow.

46. One or more non-transitory readable storage devices according to claim 45, wherein said code for causing a second software application to be performed comprises:

code for checking the event catalog to determine whether a particular event of said first workflow is identified in said event catalog; and

code for invoking a program listed in said event catalog as being associated with said particular event of said first workflow, said program sends a request to said second software application to invoke said second process.

47. One or more non-transitory readable storage devices according to claim 46, wherein:

said code for invoking a program includes code for passing one or more attributes of said identity profile to said program.

48. An apparatus that can use workflows, comprising:

a communication interface;

one or more processors in communication with said communication interface;

one or more processor readable storage devices having processor readable code embodied on said processor readable storage devices, said processor readable code for programming said one or more processors, said processor readable code comprising;

code for receiving a request for an action that requires the use of a workflow and that pertains to at least one target identity profile of an entity in the identity system, wherein the target identity profile is included in a group of identity profiles;

code for identifying a first workflow that performs the action and is associated with the target identity profile, wherein the first workflow is a workflow for which a user issuing the request to perform the action is authorized;

code for initiating, in response to receiving the request and identifying the first workflow, the first workflow at said identity system;

code for performing, as part of said first workflow, a first task to modify an identity profile for one or more users, said identity profile comprising information for determining a set of access rights specifying whether said one or more users can access a resource on a computer;

code for starting a second workflow as a subflow of said first workflow according with custom function provided by a third party system external to the identify system, wherein the function responses to an associated event in an event catalog comprising pre and post events, and the starting of the second workflow includes providing a callback command that is used to restart said first workflow;

code for performing, as part of said second workflow, a second task pertaining to said identity profile;

wherein, said first workflow is performed by a first software application and said second workflow is performed by a second software application;

code for accessing an indication that said first workflow should wait for said second workflow to complete said second task, wherein said indication is a result code indicating that said first workflow should pause, wherein the pause includes waiting to invoke said first workflow until said callback command is invoked; and

code for waiting for said second workflow to complete said second task then invoke the callback command to restart said first workflow.

49. An apparatus according to claim 48, wherein said code for starting a second workflow comprises:

code for checking the event catalog to determine whether a particular event of said first workflow is identified in said event catalog; and

code for invoking a process listed in said event catalog as being associated with said particular event of said first workflow, said process includes initiating said second workflow.

50. An apparatus according to claim 48, wherein said code for starting a second workflow comprises:

code for determining that a particular step of said first workflow includes a supplied variable;

code for searching for one or more workflows that can provide said supplied variable;

code for identifying said second workflow as a result of said step of searching; and

code for initiating said second workflow.

51. An apparatus according to claim 48, wherein said processor readable code further comprises:

code for starting one or more additional nested workflows as subflows of said second workflow.

52. An apparatus that can use workflows, comprising:

a communication interface;

one or more processors in communication with said communication interface;

one or more processor readable storage devices having processor readable code embodied on said processor readable storage devices, said processor readable code for programming said one or more processors, said processor readable code comprising;

code for receiving, at an identity system, a request from a first user to perform an action that modifies an identity profile for a second one or more users, said identity profile comprising information for determining a set of access rights specifying whether said one or more users can access a resource on a computer, wherein the request pertains to at least one target identity profile of an entity in the identity system, and the target identity profile is included in a group of identity profiles;

code for reporting to said first user a set of one or more workflows that said first user is allowed to initiate, each of said one or more workflows being configured to perform said action;

code for receiving, from said user, a selection of a first workflow for performing said action;

code for performing said first workflow in a first software application, said first workflow modifying said identity profile;

code for causing a second process in a second software application to be performed in response to said first workflow;

code for starting a second workflow as a subflow of said first workflow according with custom function provided by a third party system external to the identify system, wherein the function responses to an associated event in an event catalog comprising pre and post events, and the starting of the second workflow includes providing a callback command that is used to restart said first workflow;

code for performing, as part of said second workflow, a second task pertaining to said identity profile;

wherein, said first workflow is performed by a first software application and said second workflow is performed by a second software application;

code for accessing an indication that said first workflow should wait for said second workflow to complete said second task, wherein said indication is a result code indicating that said first workflow should pause, wherein the pause includes waiting to invoke said first workflow until said callback command is invoked; and

code for waiting for said second workflow to complete said second task then invoke the callback command to restart said first workflow.

53. An apparatus according to claim 52, wherein said code for causing a second software application to be performed comprises:

code for checking the event catalog to determine whether a particular event of said first workflow is identified in said event catalog; and

code for invoking a program listed in said event catalog as being associated with said particular event of said first workflow, said program sends a request to said second software application to invoke said second process.

54. An apparatus according to claim 53, wherein:

said code for invoking a program includes code for passing one or more attributes of said identity profile to said program.

55. A method for using workflows to manage an identity profile, said method comprising:

receiving, at a user management application in an identity system, a request from a first user to perform a first action, the first action comprising creating a new identity profile for a second user, the identity profile comprising information for determining a set of access rights specifying whether said one or more users can access a resource on a computer to which access is controlled by said identity system, wherein the request pertains to at least one target identity profile of an entity in the identity system, and the target identity profile is included in a group of identity profiles;

reporting to said first user a set of one or more workflows that said first user is allowed to initiate, each of said one or more workflows being configured to perform said action;

receiving, from the user, a selection of a first workflow for performing the action;

initiating, in the user management application, the first workflow;

using the first workflow to create an identity profile for the second user, the identity profile comprising a plurality of attributes, the plurality of attributes comprising a first attribute corresponding to a variable that is to be supplied;

determining that a second workflow exists to supply the variable;

initiating the second workflow, from the first workflow, to supply the variable;

supplying the variable by writing a result of the second workflow to the identity profile according with custom function provided by a third party system external to the identify system, wherein the function responses to an associated event in an event catalog comprising pre and post events, and starting of the second workflow includes providing a callback command that is used to restart said first workflow;

initiating, from the first workflow, a third workflow in a group management application;

using the third workflow, in the group management application, to subscribe the identity profile to a specified group;

using said identity profile to grant access to resources across multiple web servers from a single web-based authentication;

wherein, said first workflow is performed by a first software application, said second workflow is performed by a second software application, and said third workflow is performed by a third software application;

accessing an indication that said first workflow should wait for said second workflow to complete said second task, wherein said indication is a result code indicating that said first workflow should pause, wherein the pause includes waiting to invoke said first workflow until said callback command is invoked; and

waiting for said second workflow to complete said second task then invoke the callback command to restart said first workflow.