US 2010/0306775 A1Published application

Role based delegated administration model

AssigneeMicrosoft Corporation

InventorsMadan R. Appiah, Malcolm E. Pearson, Daniel Kershaw

Life of this patent

Estimating the term…

Loading patent…

Abstract

Embodiments disclosed herein extend to the use of administrative roles in a multi-tenant environment. The administrative roles define administrative tasks defining privileged operations that may be performed on the resources or data of a particular tenant. In some embodiments, the administrative tasks are a subset of administrative tasks. The administrative role also defines target objects which may be subjected to the administrative tasks. In some embodiments, the target objects are a subset of target objects. An administrator may associate a user or group of users of the particular tenant with a given administrative role. In this way, the user or group of users are delegated permission to perform the subset of administrative tasks on the subset of target objects without having to be given permission to perform all administrative tasks on all target objects.

Claims20

Dependent claims

In a multi-tenant environment including two or more tenants, wherein a management console provides administration services for each tenant and also stores data for each tenant, the data being stored in a manner that is secure to the tenant that owns the data, a method for defining administrative roles that specify administrative tasks that can be performed on the resources and data belonging to a tenant so that an administrator of the tenant may delegate a subset of the administrative tasks to a user associated with the tenant, the method comprising:

defining at the management console one or more administrative tasks that define privileged operations;
defining at the management console one or more administrative roles;
assigning at the management console a set of the one or more administrative tasks to each of the one or more administrative roles, wherein each set of administrative tasks differs for each administrative role;
and
identifying at the management console, for each of the defined one or more administrative roles, and for each administrative task assigned to the corresponding administrative role, which one or more target objects is to be subjected to the corresponding administrative task given the corresponding administrative role.

2 more elements

In a multi-tenant environment including two or more tenants, wherein a management console provides administration services for each tenant and also stores data for each tenant, the data being stored in a manner that is secure to the tenant that owns the data, a method for a user associated with a tenant to obtain permission to perform one or more administrative tasks that have been delegated to the user, the method comprising:

receiving at the management console a user request for access to perform one or more administrative tasks on a designated target object, wherein the administrative tasks define privileged operations;
determining at the management console an identity of the user;
mapping at the management console the user to an administrative role based on the identity, wherein the administrative role defines a set of administrative tasks that the user is allowed to perform and a set of target objects on which the set of administrative tasks may be performed for each task of the set of administrative tasks;
determining at the management console if the one or more administrative tasks the user desires to perform is permitted by the administrative role based on the mapping;
and
determining at the management console if the designated target object is permitted by the administrative role to be subjected to the desired one or more administrative tasks.

3 more elements

Dependencies are inferred from the claim text.