Unified provisioning of applications on devices in an enterprise system

Patent metadata

Field	Value
Publication number	US-11089474-B2
Application number	US-201816161939-A
Country	US
Kind code	B2
Filing date	Oct 16, 2018
Priority date	Sep 24, 2014
Publication date	Aug 10, 2021
Grant date	Aug 10, 2021

Abstract

The present disclosure relates generally to managing access to an enterprise system using remote devices. Techniques are disclosed for provisioning applications on remote devices to access resources in an enterprise system. Specifically, applications may be automatically configured with access information (e.g., account information) and connection information to access a resource in an enterprise system using a remote device. Configuring an application may include determining an account for accessing a resource using the application. An account may be provisioned if one has not been established. Upon configuring an application, the device access management system may provide a configured application to the remote device(s) for which the application is configured. Once the configured application is received, the application may be automatically installed on the remote device, after which the application may be executed to access a resource.

First claim

What is claimed is:

1. A method comprising:
determining an account enabling an identity of a user to access a first resource, wherein the first resource is accessible from a first device using a first application, wherein the first device is registered for the identity of the user;
configuring, by a computer system, the first application based on a user role associated with the identity of the user;
provisioning, by the computer system, the first application with access to the first resource using the first device registered for the identity of the user;
detecting a change in the user role from a first user role to a second user role;
determining, based on the second user role, a change in access permitted to the identity of the user by the account;
detecting a plurality of devices registered for the identity of the user;
transmitting the first application to the plurality of devices after configuring the first application based on the change in the user role; and
instructing each of the plurality of devices to modify a configuration of the first application based on the change in access.

2. The method of claim 1 , wherein the provisioning includes:
configuring the first application with access information that enables the first application to access the first resource, wherein the access information is based on access permitted to the identity of the user by the account.

3. The method of claim 1 , wherein the provisioning includes:
configuring the first application with connection information that enables the first application to connect the first device to a target system that provides access to the first resource; and
transmitting the first application to the first device.

4. The method of claim 3 , further comprising:
detecting a second device registered for the identity of the user, wherein the connection information configured for the first application further enables the first application to connect the second device to the target system; and
transmitting the first application to the second device.

5. The method of claim 1 , further comprising:
detecting a change in the user role from a first user role to a second user role;
determining, based on the second user role, a change in access permitted to the identity of the user by the account; and
instructing the first device to modify a configuration of the first application based on the change in access.

6. The method of claim 5 , wherein the change in access permitted to the identity of the user includes revoking access permitted to the first resource by the account for the identity of the user, and wherein modifying the configuration of the first application includes deleting connection information configured for the first application.

7. The method of claim 5 , wherein the change in access permitted to the identity of the user includes revoking access permitted to the first resource by the account for the identity of the user, and wherein modifying the configuration of the first application includes removing the first application from the first device.

8. The method of claim 5 , wherein modifying the configuration of the first application includes adjusting access information configured for the first application.

9. The method of claim 1 , further comprising:
transmitting the first application to the plurality of devices upon configuring the first application with connection information.

10. The method of claim 1 , further comprising:
detecting a change in the user role from a first user role to a second user role;
determining, based on the second user role, that the account enables the identity of the user to access a second resource, wherein the second resource is accessible from the first device using a second application;
configuring, by the computer system, the second application to connect the first device to a second target system that provides access for the second resource; and
transmitting the second application to the first device.

11. A non-transitory computer-readable medium comprising instructions stored thereon, that when executed by one or more processors, cause the one or more processors to perform operations comprising:
determining an account enabling an identity of a user to access a first resource, wherein the first resource is accessible from a first device using a first application, wherein the first device is registered for the identity of the user;
configuring, by a computer system, the first application based on a user role associated with the identity of the user;
provisioning, by the computer system, the first application with access to the first resource using the first device registered for the identity of the user;
detecting a change in the user role from a first user role to a second user role;
determining, based on the second user role, a change in access permitted to the identity of the user by the account;
detecting a plurality of devices registered for the identity of the user;
transmitting the first application to the plurality of devices after configuring the first application based on the change in the user role; and
instructing each of the plurality of devices to modify a configuration of the first application based on the change in access.

12. The non-transitory computer-readable medium of claim 11 , wherein the provisioning includes:
configuring the first application with access information that enables the first application to access the first resource, wherein the access information is based on access permitted to the identity of the user by the account.

13. The non-transitory computer-readable medium of claim 11 , wherein the provisioning includes:
configuring the first application with connection information that enables the first application to connect the first device to a target system that provides access to the first resource; and
transmitting the first application to the first device.

14. The non-transitory computer-readable medium of claim 13 , wherein the operations further comprise:
detecting a second device registered for the identity of the user, wherein the connection information configured for the first application further enables the first application to connect the second device to the target system; and
transmitting the first application to the second device.

15. The non-transitory computer-readable medium of claim 11 , wherein the operations further comprise:
detecting a change in the user role from a first user role to a second user role;
determining, based on the second user role, a change in access permitted to the identity of the user by the account; and
instructing the first device to modify a configuration of the first application based on the change in access.

16. A server system comprising a memory, the server system executing instructions in a computer program, the computer program instructions comprising program code for:
determining an account enabling an identity of a user to access a first resource, wherein the first resource is accessible from a first device using a first application, wherein the first device is registered for the identity of the user;
configuring, by a computer system, the first application based on a user role associated with the identity of the user;
provisioning, by the computer system, the first application with access to the first resource using the first device registered for the identity of the user;
detecting a change in the user role from a first user role to a second user role;
determining, based on the second user role, a change in access permitted to the identity of the us

Assignees

• Oracle Int Corp

Inventors

• Maheshwari Harsh
• Mohamad Abdul Mohamad Raja Gani
• Das Sidhartha
• Pakkath Rajesh
• Katti Sreedhar

Classifications

• H04L67/75

  Indicating network or usage conditions on the user display · CPC title

• H04L67/52

  specially adapted for the location of the user terminal · CPC title

• H04W12/71

  Hardware identity · CPC title

• H04W12/33

  using wearable devices, e.g. using a smartwatch or smart-glasses · CPC title

• H04W12/06 Primary

  Authentication · CPC title