Access policy management using identified roles

• US 9,602,545 B2
• Filed: 01/12/2015
• Issued: 03/21/2017
• Est. Priority Date: 01/13/2014
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Pitre, Ashutosh
• Primary Examiner(s): Patel, Haresh N
• Application Number:
  US14/594,690
• Publication Number:
  US 20150200943A1
• Time in Patent Office: 799 Days
• Field of Search: 726/1, 726/4, 726/6
• US Class Current: 1/1
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

The present disclosure relates generally to techniques for automatically associating one or more access policies with an account. Specifically, these techniques enable one or more access policies to retroactively be associated with an account that is not associated with at least one access policy. By associating an access policy with an account, managing access to one or more resources provided by the account may be automated based on the associated access policy. An identity management system (IDM) system may manage access policies for determining access to resources of target systems. Accounts that are not associated with an access policies may be associated with the access policies governing access to resources identified by those accounts. Access to the resource(s) associated with those accounts may be updated based on the access granted by the access policies which are associated with those accounts.

Claims

1. A method comprising:

identifying, by a computer system, an account associated with an identity of a user, wherein the account has an entitlement to access a resource of a target system;

determining, by the computer system, a set of access policies that are used to manage access to one or more resources of the target system;

determining, by the computer system, that the account is not managed by an access policy in the set of access policies;

identifying, by the computer system, a role associated with the identity;

determining, by the computer system, a first access policy in the set of access policies, the first access policy being determined as associated with the identified role;

determining a value of an attribute in access policy data corresponding to the first access policy, wherein the value of the attribute indicates whether the first access policy is to be associated with one or more accounts enabling access to the resource of the target system;

storing, by the computer system, data indicating an association between the account and the first access policy based on determining that the identified role is associated with the first access policy and based on the value of the attribute;

detecting a change in the first access policy, wherein the change is associated with the access to the resource of the target system; and

sending, by the computer system, a request to the target system, wherein the request causes the target system to configure the account to change the access to the resource based on the detected change in the first access policy.

2. The method of claim 1, further comprising:

receiving, from the target system, account data identifying the account, wherein the account is created by the target system.

3. The method of claim 1, wherein each access policy of the set of access policies indicates an entitlement to access the resource of the target system by one or more roles.

4. The method of claim 1, wherein the account is created before the first access policy is created.

5. The method of claim 1, wherein the account is created after the first access policy is created.

6. The method of claim 1, wherein each access policy of the set of access policies is associated with an identifier, and wherein associating the account with the first access policy includes storing the identifier corresponding to the first access policy in association with account data corresponding to the account.

7. The method of claim 1, wherein the resource of the target system corresponds to an application provided by the target system.

8. The method of claim 1, wherein the resource of the target system corresponds to a computing system accessible from the target system.

9. The method of claim 1, wherein determining that the account is not associated with an access policy includes:

determining policy profile data corresponding to a policy profile associated with the identity; and

determining whether the policy profile data indicates an association between the first access policy and an identifier corresponding to the target system; and

wherein the account is not associated with the access policy when the policy profile data does not indicate an association between the first access policy and the identifier corresponding to the target system.

10. The method of claim 9, wherein the identifier corresponding to the target system is based on information identifying the resource of the target system and an account identifier corresponding to the account associated with the identity.

11. A computer system of an identity management system, the computer system comprising:

one or more processors; and

a memory storing instructions that, when executed by the one or more processors, cause the one or more processors to;

identify account data corresponding to an account associated with an identity of a user, wherein the account data has an entitlement to access a resource of a target system;

identify policy profile data corresponding to a policy profile associated with the identity;

determine whether the policy profile data indicates an association between an identifier corresponding to the target system and an access policy that grants access to the resource of the target system by a role associated with the identity;

determine that the account is not managed by an access policy when the policy profile data does not indicate an association between the identifier and the access policy that manages access to the resource of the target system;

determine a set of access policies that are used to manage access to the resource;

identify from the set of access policies, a first access policy, the first access policy being determined as associated with the identified role;

determine a value of an attribute in access policy data corresponding to the first access policy, wherein the value of the attribute indicates whether the first access policy is to be associated with one or more accounts enabling access to the resource of the target system;

store data indicating an association between the account and the first access policy based on determining that the role is associated with the first access policy and based on the value of the attribute

detect a change in the first access policy, wherein the change is associated with the access to the resource of the target system; and

send a request to the target system, wherein the request causes the target system to configure the account to change the access to the resource based on the detected change in the first access policy.

12. The computer system of claim 11, wherein the identifier corresponding to the target system is based on information identifying the resource of the target system and an account identifier corresponding to the account associated with the identity.

13. The computer system of claim 11, wherein the account is a bulk-loaded account or a reconciled account.

14. The computer system of claim 13, wherein the instructions, when executed by the one or more processors, further cause the one or more processors to:

receive, from the target system, data indicating a plurality of accounts created by the target system, wherein the data includes the account data corresponding to the account.

15. A non-transitory computer-readable memory storing a set of instructions that are executable by one or more processors to:

identify an account associated with an identity of a user, wherein the account has an entitlement to access a resource of a target system;

determine a set of access policies that are used to manage access to one or more resources of the target system;

determine that the account is not managed by an access policy in the set of access policies;

identify a role associated with the identity;

determine a first access policy in the set of access policies, the first access policy being determined as associated with the identified role;

determine a value of an attribute in the access policy data corresponding to the first access policy, wherein the attribute indicates whether the first access policy can be associated with accounts created for accessing the resource of the target system;

store data indicating an association between the account and the first access policy based on determining that the identified role is associated with the first access policy and based on the value of the attribute;

detect a change in the first access policy, wherein the change is associated with the access to the resource of the target system; and

send a request to the target system, wherein the request causes the target system to configure the account to change the access to the resource based on the detected change in the first access policy.

16. The non-transitory computer-readable memory of claim 15, wherein determining that the account is not associated with an access policy includes:

determining policy profile data corresponding to a policy profile associated with the identity; and

determining whether the policy profile data indicates an association between the first access policy and an identifier corresponding to the target system;

wherein the account is not associated with the access policy when the policy profile data does not indicate an association between the first access policy and the identifier corresponding to the target system; and

wherein the identifier corresponding to the target system is based on information identifying the resource of the target system and an account identifier corresponding to the account associated with the identity.

17. The non-transitory computer-readable memory of claim 15, wherein the set of instructions are further executable by one or more processors to:

receive, from the target system, account data corresponding to a plurality of accounts, wherein each account is a bulk-loaded account or a reconciled account created by one of a plurality of target systems, and wherein the plurality of accounts includes the account.

18. The non-transitory computer-readable memory of claim 17, wherein the account is created before the first access policy is created.