Domain based workflows

• US 9,235,649 B2
• Filed: 08/10/2010
• Issued: 01/12/2016
• Est. Priority Date: 12/22/2000
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Teng, Joan C., Remahl, Thomas B.
• Primary Examiner(s): TAPP, AMELIA L
• Application Number:
  US12/854,052
• Publication Number:
  US 20110055673A1
• Time in Patent Office: 1,981 Days
• Field of Search: 715/200, 715/201
• US Class Current: 1/1
• CPC Class Codes: G06F 16/972 Access to data in other repository systems, e.g. legacy data or dynamic Web page generation
• CPC Class Codes: G06F 16/986 Document structures and storage, e.g. HTML extensions
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/564 Enhancement of application control based on intercepted application data
• CPC Class Codes: H04L 67/565 Conversion or adaptation of application format or content adding application control or application functional data H04L67/561
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

Technology is disclosed for using workflows based on domains in a hierarchical data structure (e.g. LDAP directory) or other type of data structure. When a workflow is created, it is associated with domain. The domain is defined by a selected node and all nodes below that selected node in the hierarchical data structure. At run time, the system identifies which workflows perform a requested task and are associated with a domain that includes the target of the task. If multiple workflows are determined, the user is provided with the ability to choose one of the identified workflows for performing the tasks.

Claims

1. A computer-implemented method for selecting a workflow of a plurality of workflows to perform a task, the method comprising:

associating by an identity server each workflow of the plurality of workflows with a different corresponding portion of a hierarchical directory structure, each portion of the directory structure storing identity profile object information associated with a plurality of different entities,

wherein the plurality of difference entities comprise at least one organization, at least one group within the organization, and at least one user within the group,

wherein the plurality of workflows comprises workflows that are different from each other, and

wherein each workflow in the plurality of workflows is capable of performing the task;

receiving by the identity server a request to perform the task wherein the task affects a first identity profile object associated with one of the entities and storing identity information for the associated entity;

determining by the identity server a portion of the directory structure storing identity profile object information for the entity associated with the first identity profile object;

determining by the identity server a workflow associated with the determined portion of the directory structure and capable of performing the task;

performing, by the identity server as part of said workflow, a first task to affect the first identity profile, said identity profile comprising information for determining a set of access rights; and

starting by the identity server a subflow of said workflow, wherein the starting of the subflow includes providing a callback command that can be used to restart said workflow;

performing, as part of said subflow, a second task pertaining to said identity profile;

accessing an indication of whether said workflow should wait for said subflow to complete said second task, wherein said indication is a result code indicating that said workflow should pause, wherein the pause include waiting to invoke said workflow until said callback command is invoked; and

waiting for said subflow to complete said second task if said indication indicates to wait for said subflow to complete said second task.

2. The method of claim 1 wherein, each workflow uses a predefined set of steps for performing the task and wherein the workflows in the plurality of workflows differ from each other in at least one step of the predefined set of steps.

3. The method of claim 1 further comprising executing by the identity server a predefined set of steps of the determined workflow for performing the task.

4. The method of claim 3, wherein executing the predefined set of steps of the determined workflow affects the first identity profile object by modifying one or more attributes of the first identity profile object.

5. The method of claim 1 wherein the entity represents one of:

person, group of users, department, server, or printer and is identified by a set of attributes.

6. The method of claim 1 wherein the task is a task to create the first identity profile object, delete the first identity profile object, or change an attribute of the first identity profile object.

7. The method of claim 1 wherein the directory structure is an LDAP directory structure.

8. The method of claim 7 wherein associating each workflow of the plurality of workflows with the corresponding portion of the directory structure comprises specifying the corresponding portion of the directory structure using an LDAP filter.

9. The method of claim 1 wherein the steps of associating, receiving, and determining are performed by an integrated identity and access system.

10. The method of claim 1 wherein the request includes an identification of the first identity profile object.

11. The method of claim 1, further comprising, when the determining from the plurality of workflows determines more than one workflow as being associated with the determined portion of the directory structure and capable of performing the task:

outputting by the identity server a list of the more than one workflow to a user; and

receiving by the identity server from the user a selection of the determined workflow for performing the task.

12. The method of claim 1, wherein said workflow is performed by a first software application and said subflow is performed by a second software application.

13. A processor readable storage device storing plurality of instructions causing a processor to select a workflow of a plurality of workflows to perform a task, the plurality of instructions comprising code for:

associating by an identity server each workflow of the plurality of workflows with a different corresponding portion of a directory structure, each portion of the directory structure storing identity profile object information, the identity profile object information associated with a plurality of different entities,

wherein the plurality of difference entities comprise at least one organization, at least one group within the organization, and at least one user within the group,

wherein the plurality of workflows comprises workflows that are different from each other, and

wherein each workflow in the plurality of workflows is capable of performing the task;

receiving by the identity server a request to perform the task wherein the task affects a first identity profile object associated with one of the entities and storing identity information for the associated entity;

determining by the identity server a portion of the directory structure storing identity profile object information for the entity associated with the first identity profile object;

determining by the identity server a workflow associated with the determined portion of the directory structure and capable of performing the task;

performing, by the identity server as part of said workflow, a first task to affect the first identity profile, said identity profile comprising information for determining a set of access rights; and

starting by the identity server a subflow of said workflow, wherein the starting of the subflow includes providing a callback command that can be used to restart said workflow;

performing, as part of said subflow, a second task pertaining to said identity profile;

accessing an indication of whether said workflow should wait for said subflow to complete said second task, wherein said indication is a result code indicating that said workflow should pause, wherein the pause include waiting to invoke said workflow until said callback command is invoked; and

waiting for said subflow to complete said second task if said indication indicates to wait for said subflow to complete said second task.

14. The processor readable storage device of claim 13 wherein, each workflow uses a predefined set of steps for performing the task and wherein the workflows in the plurality ofworkflows differ from each other in at least one step of the predefined set of steps.

15. The processor readable storage device of claim 13 further comprising executing a predefined set of steps of the-determined workflow for performing the task and wherein executing the predefined set of steps of the determined workflow affects the first identity profile object by modifying one or more attributes of the first identity profile object.

16. The processor readable storage device of claim 13 wherein the entity represents one of:

person, group of users, department, server, or printer and is identified by a set of attributes.

17. The processor readable storage device of claim 13 wherein the task is a task to create the first identity profile object, delete the first identity profile object, or change an attribute of the first identity profile object.

18. The processor readable storage device of claim 13 wherein the directory structure is an LDAP directory structure and wherein associating each workflow of the plurality of workflows with the corresponding portion of the directory structure comprises specifying the corresponding portion of the directory structure using an LDAP filter.

19. A computing system comprising:

a memory; and

a processor coupled to the memory and configured to execute instructions for;

associating each workflow of the plurality of workflows with a different corresponding portion of a directory structure, each portion of the directory structure storing identity profile object information associated with a plurality of different entities,

wherein the plurality of difference entities comprise at least one organization, at least one group within the organization, and at least one user within the group,

wherein the plurality of workflows comprises workflows that are different from each other, and

wherein each workflow in the plurality of workflows is capable of performing the task;

receiving a request to perform the task wherein the task affects a first identity profile object associated with one of the entities and storing identity information for the associated entity;

determining a first portion of the directory structure storing identity profile object information for the entity associated with the first identity profile object;

determining a first workflow of the plurality of workflows associated with the determined portion of the directory structure and capable of performing the task;

performing, by the identity server as part of said workflow, a first task to affect the first identity profile, said identity profile comprising information for determining a set of access rights; and

starting by the identity server a subflow of said workflow, wherein the starting of the subflow includes providing a callback command that can be used to restart said workflow;

performing, as part of said subflow, a second task pertaining to said identity profile;

accessing an indication of whether said workflow should wait for said subflow to complete said second task, wherein said indication is a result code indicating that said workflow should pause, wherein the pause include waiting to invoke said workflow until said callback command is invoked; and

waiting for said subflow to complete said second task if said indication indicates to wait for said subflow to complete said second task.

20. The computing system of claim 19 wherein, each workflow uses a predefined set of steps for performing the task and wherein the workflows in the plurality of workflows differ from each other in at least one step of the predefined set of steps.

21. The computing system of claim 19 wherein the entity represents one of:

person, group of users, department, server, or printer and is identified by a set of attributes.