IP Library › Granted Patent US 12701006
Granted Patent B2
US 12701006 · App. 18/422,812 · Granted Aug 4, 2026

Compartment level binding for workload identity

Inventors: Jacob M. Lindholm (Londonderry, NH); Joshua Aaron Horwitz (Centreville, VA); Abhinav Mishra (Livermore, CA); Karl Halley Heiss (Raleigh, NC)
Assignee: Oracle International Corporation
H04L9/3213G06F16/27H04L63/083
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12701006
App. No.
18/422,812
Granted
Aug 4, 2026
Kind
B2
Abstract

Techniques are described for mapping a namespace to a compartment. An example method includes receiving, by a manager instance and from a pod, a first request for a token. The manager instance can transmit, to a token issuance service, a second request for the token. The token issuance service can identify a mapping object that maps the namespace to the resource. The token issuance service can transmit, to an identity service, the mapping object and a third request for the token. The identity service can identify a compartment of the customer tenancy based at least in part on the compartment identifier, the compartment managing the resource. The identity service can determine whether the pod has permission to access the resource. The identity service can generate the token based at least in part on the mapping object and the policy. The identity service can transmit the token to the pod.

Claims (108)

1 . A method, comprising:

receiving, by a manager instance of a computing system and from a pod, a first request for a token used to access a resource managed by a customer tenancy, the pod managed by a provider tenancy and associated with a namespace;

transmitting, by the manager instance of the computing system and to a token issuance service of the computing system, a second request for the token;

identifying, by the token issuance service of the computing system, a mapping object that maps the namespace to the resource, the mapping object comprising a namespace identifier and a compartment identifier;

transmitting, by the token issuance service of the computing system and to an identity service of the computing system, the mapping object and a third request for the token;

identifying, by the identity service of the computing system, a compartment of the customer tenancy based at least in part on the compartment identifier, the compartment managing the resource;

accessing, by the identity service of the computing system, a policy stored in a compartment;

determining, by the identity service of the computing system, whether the pod has permission to access the resource based at least in part on the policy;

generating, by the identity service of the computing system, the token based at least in part on the mapping object and the policy; and

transmitting, by the identity service of the computing system, the token to the pod.

2 . The method of claim 1 , wherein the mapping object comprises a second instance of the mapping object, and wherein the method further comprises:

receiving, by a gateway service of the computing system, mapping information from an entity managing the compartment;

transmitting, by the gateway service of the computing system and to a container service of the computing system, the mapping information;

generating, by the container service of the computing system, a first instance of the mapping object based at least in part on the mapping information; and

storing, by the container service of the computing system, the first instance of the mapping object in a first database.

3 . The method of claim 2 , wherein the method further comprises:

transmitting, by the first database and to a synchronization controller, a record of storing the first instance of the mapping object based at least in part on storing the first instance of the mapping object in the first database;

accessing, by the synchronization controller, the first instance of the mapping object in the first database based at least in part on the record;

generating, by the synchronization controller, the second instance of the mapping object; and

storing, by the synchronization controller, the second instance of the mapping object in a second database associated with the token issuance service.

4 . The method of claim 3 , wherein the mapping object is associated with a cell, wherein the mapping object further comprises a cell identifier, and wherein determining whether a mapping object that maps the namespace to the resource has been created comprises:

transmitting, by a synchronization controller, a message to the first database as to whether any mapping object has been stored in the first database, wherein the message includes the cell identifier;

determining, by the first database, whether the first instance of the mapping object is associated with the cell based at least in part on the cell identifier;

transmitting, by the first database and to the synchronization controller, a response indicating whether the first instance of the mapping object is stored in the first database;

accessing, by the synchronization controller, the first instance of the mapping object in the first database based at least in part on the response;

generating, by the synchronization controller, a second instance of the mapping object, wherein the mapping object comprises the second instance of the mapping object; and

storing, by the synchronization controller, the second instance of the mapping object in a second database associated with the token issuance service.

5 . The method of claim 2 , wherein the method further comprises:

transmitting, by a synchronization controller, a message to the first database as to whether any mapping object has been stored in the first database;

receiving, by the synchronization controller and based at least in part on the message, a response from the first database that the first instance of the mapping object has been stored in the first database;

accessing, by the synchronization controller, the first instance of the mapping object in the first database based at least in part on receiving the response;

generating, by the synchronization controller, the second instance of the mapping object; and

storing, by the synchronization controller, the second instance of the mapping object in a second database associated with the token issuance service.

6 . The method of claim 2 , wherein the mapping object is stored in a second database, and wherein the second database is configured to store a set number of mapping objects.

7 . The method of claim 1 , wherein the method further comprises:

validating, by the manager instance of the computing system, the first request, wherein the manager instance transmits the second request based at least in part on the validating the first request.

8 . A computing system comprising:

one or more processors; and

one or more computer-readable media having stored thereon a sequence of instructions that, when executed, cause the one or more processors to:

receive, by a manager instance of the computing system and from a pod, a first request for a token used to access a resource managed by a customer tenancy, the pod managed by a provider tenancy and associated with a namespace;

transmit, by the manager instance of the computing system and to a token issuance service of the computing system, a second request for the token;

identify, by the token issuance service of the computing system, a mapping object that maps the namespace to the resource, the mapping object comprising a namespace identifier and a compartment identifier;

transmit, by the token issuance service of the computing system and to an identity service of the computing system, the mapping object and a third request for the token;

identify, by the identity service of the computing system, a compartment of the customer tenancy based at least in part on the compartment identifier, the compartment managing the resource;

access, by the identity service of the computing system, a policy stored in a compartment;

determine, by the identity service of the computing system, whether the pod has permission to access the resource based at least in part on the policy;

generate, by the identity service of the computing system, the token based at least in part on the mapping object and the policy; and

transmit, by the identity service of the computing system, the token to the pod.

9 . The computing system of claim 8 , wherein the mapping object comprises a second instance of the mapping object, and wherein the sequence of instructions, when executed, cause the one or more processors to:

receive, by a gateway service of the computing system, mapping information from an entity managing the compartment;

transmit, by the gateway service of the computing system and to a container service of the computing system, the mapping information;

generate, by the container service of the computing system, a first instance of the mapping object based at least in part on the mapping information; and

store, by the container service of the computing system, the first instance of the mapping object in a first database.

10 . The computing system of claim 9 , wherein the sequence of instructions, when executed, cause the one or more processors to:

transmit, by the first database and to a synchronization controller, a record of storing the first instance of the mapping object based at least in part on storing the first instance of the mapping object in the first database;

access, by the synchronization controller, the first instance of the mapping object in the first database based at least in part on the record;

generate, by the synchronization controller, the second instance of the mapping object; and

storing, by the synchronization controller, the second instance of the mapping object in a second database associated with the token issuance service.

11 . The computing system of claim 10 , wherein the mapping object is associated with a cell, wherein the mapping object further comprises a cell identifier, and wherein determining whether a mapping object that maps the namespace to the resource has been created comprises:

transmitting, by a synchronization controller, a message to the first database as to whether any mapping object has been stored in the first database, wherein the message includes the cell identifier;

determining, by the first database, whether the first instance of the mapping object is associated with the cell based at least in part on the cell identifier;

transmitting, by the first database and to the synchronization controller, a response indicating whether the first instance of the mapping object is stored in the first database;

accessing, by the synchronization controller, the first instance of the mapping object in the first database based at least in part on the response;

generating, by the synchronization controller, a second instance of the mapping object, wherein the mapping object comprises the second instance of the mapping object; and

storing, by the synchronization controller, the second instance of the mapping object in a second database associated with the token issuance service.

12 . The computing system of claim 9 , wherein the sequence of instructions, when executed, cause the one or more processors to:

transmit, by a synchronization controller, a message to the first database as to whether any mapping object has been stored in the first database;

receive, by the synchronization controller and based at least in part on the message, a response from the first database that the first instance of the mapping object has been stored in the first database;

access, by the synchronization controller, the first instance of the mapping object in the first database based at least in part on receiving the response;

generate, by the synchronization controller, the second instance of the mapping object; and

store, by the synchronization controller, the second instance of the mapping object in a second database associated with the token issuance service.

13 . The computing system of claim 9 , wherein the mapping object is stored in a second database, and wherein the second database is configured to store a set number of mapping objects.

14 . The computing system of claim 8 , wherein the sequence of instructions, when executed, cause the one or more processors to:

validating, by the manager instance of the computing system, the first request, wherein the manager instance transmits the second request based at least in part on the validating the first request.

15 . One or more non-transitory computer-readable media having stored thereon a sequence of instructions that, when executed by one or more processors of a computing system, cause the computing system to:

receive, by a manager instance of the computing system and from a pod, a first request for a token used to access a resource managed by a customer tenancy, the pod managed by a provider tenancy and associated with a namespace;

transmit, by the manager instance of the computing system and to a token issuance service of the computing system, a second request for the token;

identify, by the token issuance service of the computing system, a mapping object that maps the namespace to the resource, the mapping object comprising a namespace identifier and a compartment identifier;

transmit, by the token issuance service of the computing system and to an identity service of the computing system, the mapping object and a third request for the token;

identify, by the identity service of the computing system, a compartment of the customer tenancy based at least in part on the compartment identifier, the compartment managing the resource;

access, by the identity service of the computing system, a policy stored in a compartment;

determine, by the identity service of the computing system, whether the pod has permission to access the resource based at least in part on the policy;

generate, by the identity service of the computing system, the token based at least in part on the mapping object and the policy; and

transmit, by the identity service of the computing system, the token to the pod.

16 . The one or more non-transitory computer-readable media of claim 15 , wherein the mapping object comprises a second instance of the mapping object, and wherein the sequence of instructions, when executed, cause the one or more processors to:

receive, by a gateway service of the computing system, mapping information from an entity managing the compartment;

transmit, by the gateway service of the computing system and to a container service of the computing system, the mapping information;

generate, by the container service of the computing system, a first instance of the mapping object based at least in part on the mapping information; and

store, by the container service of the computing system, the first instance of the mapping object in a first database.

17 . The one or more non-transitory computer-readable media of claim 16 , wherein the sequence of instructions, when executed, cause the one or more processors to:

transmit, by the first database and to a synchronization controller, a record of storing the first instance of the mapping object based at least in part on storing the first instance of the mapping object in the first database;

access, by the synchronization controller, the first instance of the mapping object in the first database based at least in part on the record;

generate, by the synchronization controller, the second instance of the mapping object; and

storing, by the synchronization controller, the second instance of the mapping object in a second database associated with the token issuance service.

18 . The one or more non-transitory computer-readable media of claim 17 , wherein the mapping object is associated with a cell, wherein the mapping object further comprises a cell identifier, and wherein determining whether a mapping object that maps the namespace to the resource has been created comprises:

transmitting, by a synchronization controller, a message to the first database as to whether any mapping object has been stored in the first database, wherein the message includes the cell identifier;

determining, by the first database, whether the first instance of the mapping object is associated with the cell based at least in part on the cell identifier;

transmitting, by the first database and to the synchronization controller, a response indicating whether the first instance of the mapping object is stored in the first database;

accessing, by the synchronization controller, the first instance of the mapping object in the first database based at least in part on the response;

generating, by the synchronization controller, a second instance of the mapping object, wherein the mapping object comprises the second instance of the mapping object; and

storing, by the synchronization controller, the second instance of the mapping object in a second database associated with the token issuance service.

19 . The one or more non-transitory computer-readable media of claim 16 , wherein the sequence of instructions, when executed, cause the one or more processors to:

transmit, by a synchronization controller, a message to the first database as to whether any mapping object has been stored in the first database;

receive, by the synchronization controller and based at least in part on the message, a response from the first database that the first instance of the mapping object has been stored in the first database;

access, by the synchronization controller, the first instance of the mapping object in the first database based at least in part on receiving the response;

generate, by the synchronization controller, the second instance of the mapping object; and

store, by the synchronization controller, the second instance of the mapping object in a second database associated with the token issuance service.

20 . The one or more non-transitory computer-readable media of claim 16 , wherein the mapping object is stored in a second database, and wherein the second database is configured to store a set number of mapping objects.