IP Library › Granted Patent US 12699795
Granted Patent B2
US 12699795 · App. 18/883,343 · Granted Aug 4, 2026

Automated authorization management of database accounts

Inventors: Clete Rivers Blackwell, II (Dawsonville, GA); Hairong Liu (Canton, GA)
Assignee: State Farm Mutual Automobile Insurance Company
G06F21/6218G06F16/27G06F2221/2113G06F2221/2141
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12699795
App. No.
18/883,343
Granted
Aug 4, 2026
Kind
B2
Abstract

Techniques described herein relate to automated management of database accounts within cloud environments and other large-scale computing environments. In such environments, an identity provider service for an organization may maintain the various roles for the users associated with the organization. As described herein, a database account synchronization system may synchronize the user accounts within the database systems of the organization based on the corresponding roles stored within the identity provider. In some examples, the database account synchronization system may periodically query the identity provider to retrieve user-role mappings for the various user groups defined by the identity provider. For each user group, the database account synchronization system may query the organization database systems, compare the user permissions of each database to the user-role mappings within the identity provider, and update the database user accounts to synchronize the databases with the identity provider.

Claims (69)

1 . A computer system, comprising:

one or more processors; and

one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

receiving a request to synchronize one or more database user accounts associated with a cloud service provider, based on a current state of an identity provider service;

accessing, using first credentials, the identity provider service to determine a mapping of a first resource access role to a first user identity;

receiving, from the identity provider service, a first encrypted web token associated with the first user identity;

logging into the cloud service provider using the first encrypted web token associated with the first user identity;

receiving, from the cloud service provider, and based on successfully logging into the cloud service provider using the first encrypted web token, second credentials associated with the first user identity and different from the first credentials;

accessing a first database system associated with the cloud service provider, to determine a first database user account associated with the first user identity; and

modifying the first database user account within the first database system, based at least in part on the mapping, wherein modifying the first database user account within the first database system is performed using the second credentials from the cloud service provider.

2 . The computer system of claim 1 , wherein receiving the request to synchronize the one or more database user accounts is based on a periodic time-based synchronization trigger.

3 . The computer system of claim 1 , the operations further comprising, in response to receiving the request to synchronize the one or more database user accounts:

accessing a plurality of database systems associated with the cloud service provider, including the first database system and a second database system, wherein the first database system is implemented using first database management architecture, and the second database system is implemented using different second database management architecture;

determining, within the second database system, a second database user corresponding to the first user identity; and

modifying the second database user within the second database system, based at least in part on the mapping.

4 . The computer system of claim 1 , the operations further comprising:

accessing the identity provider service to determine a second mapping of a second resource access role to the first user identity, wherein modifying the first database user account is further based at least in part on the second mapping.

5 . The computer system of claim 1 , wherein determining the mapping of the first resource access role to the first user identity comprises:

invoking an application programming interface of the identity provider service; and

receiving, via the application programming interface, a first listing of user identities associated with the first resource access role.

6 . The computer system of claim 5 , wherein determining the first database user account corresponding to the first user identity comprises:

determining a prefix associated with the first resource access role;

querying the first database system to retrieve a second listing of database users associated with the prefix; and

comparing the first listing of user identities to the second listing of database users.

7 . The computer system of claim 1 , wherein accessing the first database system comprises initiating a connection to the first database system, wherein the connection is not made through a proxy.

8 . A method, comprising:

receiving a request to synchronize one or more database user accounts based on a current state of an identity provider service;

accessing, using first credentials, the identity provider service to determine a mapping of a first resource access role to a first user identity;

receiving, from the identity provider service, a first encrypted web token associated with the first user identity;

accessing a service provider using the first encrypted web token associated with the first user identity, and retrieving from the service provider second credentials associated with the first user identity and different from the first credentials;

accessing a first database system associated with the identity provider service to determine a first database user corresponding to the first user identity; and

modifying the first database user within the first database system, based at least in part on the mapping, wherein modifying the first database user within the first database system is performed using the second credentials from the service provider.

9 . The method of claim 8 , wherein receiving the request to synchronize the one or more database user accounts is based on a periodic time-based synchronization trigger.

10 . The method of claim 8 , further comprising, in response to receiving the request to synchronize the one or more database user accounts:

accessing a plurality of database systems associated with the identity provider service, including the first database system and a second database system, wherein the first database system is implemented using first database management architecture, and the second database system is implemented using different second database management architecture;

determining, within the second database system, a second database user corresponding to the first user identity; and

modifying the second database user within the second database system, based at least in part on the mapping.

11 . The method of claim 8 , further comprising:

accessing the identity provider service to determine a second mapping of a second resource access role to the first user identity, wherein modifying the first database user is further based at least in part on the second mapping.

12 . The method of claim 8 , wherein determining the mapping of the first resource access role to the first user identity comprises:

invoking an application programming interface of the identity provider service; and

receiving, via the application programming interface, a first listing of user identities associated with the first resource access role.

13 . The method of claim 12 , wherein determining the first database user corresponding to the first user identity comprises:

determining a prefix associated with the first resource access role;

querying the first database system to retrieve a second listing of database users associated with the prefix; and

comparing the first listing of user identities to the second listing of database users.

14 . The method of claim 8 , wherein accessing the first database system comprises initiating a connection to the first database system, wherein the connection is not made through a proxy.

15 . The method of claim 8 , wherein determining the mapping of the first resource access role to the first user identity comprises:

invoking an application programming interface of the identity provider service; and

receiving, via the application programming interface, a first listing of user identities associated with the first resource access role.

16 . The method of claim 15 , wherein determining the first database user corresponding to the first user identity comprises:

determining a prefix associated with the first resource access role;

querying the first database system to retrieve a second listing of database users associated with the prefix; and

comparing the first listing of user identities to the second listing of database users.

17 . One or more non-transitory computer-readable media storing instructions executable by a processor, wherein the instructions, when executed by the processor, cause the processor to perform operations comprising:

determining, based at least in part on a periodic time-based trigger, a database account synchronization time;

in response to reaching the database account synchronization time, accessing, using first credentials, an identity provider service to determine a mapping of a first resource access role to a first user identity;

receiving, from the identity provider service, a first encrypted web token associated with the first user identity;

accessing a service provider using the first encrypted web token associated with the first user identity, and retrieving from the service provider second credentials associated with the first user identity and different from the first credentials;

accessing a first database system associated with the identity provider service to determine a first database user corresponding to the first user identity; and

modifying the first database user within the first database system, based at least in part on the mapping, wherein modifying the first database user within the first database system is performed using the second credentials from the service provider.

18 . The one or more non-transitory computer-readable media of claim 17 , wherein accessing the first database system comprises initiating a connection to the first database system, wherein the connection is not made through a proxy.

19 . The one or more non-transitory computer-readable media of claim 17 , wherein determining the mapping of the first resource access role to the first user identity comprises:

invoking an application programming interface of the identity provider service; and

receiving, via the application programming interface, a first listing of user identities associated with the first resource access role.

20 . The one or more non-transitory computer-readable media of claim 19 , wherein determining the first database user corresponding to the first user identity comprises:

determining a prefix associated with the first resource access role;

querying the first database system to retrieve a second listing of database users associated with the prefix; and

comparing the first listing of user identities to the second listing of database users.