Light-weight credential synchronization
AssigneeMicrosoft Corporation
InventorsJingsheng Yang, Hui Shao, Rong Yu
Life of this patent
Estimating the term…
Abstract
Aspects of the subject matter described herein relate to credential synchronization. In aspects, an entity may have access to resources on two or more systems. After the entity's credentials are changed on a first system, the first system updates the credentials on a second system so that the entity can access resources on the second system using the new credentials. The first system maintains a mapping data structure that maps between the credentials data of the two systems. The first system may obtain credential requirements from the second system and provide these requirements in conjunction with receiving a request to change credentials so that a user changing the credentials may satisfy both systems.
Claims20
A method implemented at least in part by a computer, the method comprising:
- receiving a request to change first credentials to second credentials for an entity of a first system, the first system providing access to a first set of resources to entities that provide valid credentials;
- via a data structure of the first system, determining whether the entity is mapped to a second system with the first credentials for the entity, the second system providing access to a second set of resources to entities that provide valid credentials;
- if the entity is mapped to the second system, informing a synchronization manager of the first system of the request to change the first credentials to the second credentials to use in updating the first credentials of the second system.
In a computing environment, a system, comprising:
- a store operable to maintain a data structure that maps security objects of a first system to security objects of a second system, the security objects of the first system associated with entities that are allowed to access resources of the first system, the security objects of the second system associated with entities that are allowed to access resources of the second system;
- a credentials manager operable to receive a request to update first credentials to second credentials for an entity, the credentials manager further operable to update a security object of the first system that includes the first credentials to change the first credentials to the second credentials;
- and
- a credentials filter operable to provide the second credentials for sending to the second system to update a security object of the second system that is associated with the entity via the data structure, such that the second credentials allow access to a resource of the second system to which the first credentials used to provide access.
A computer storage medium having computer-executable instructions, which when executed perform actions, comprising:
- at a second system that includes first credentials for an entity that has access to a resource of the second system, from a first system that stores a mapping between entities of the first system and entities of the second system, receiving a request to update the first credentials to second credentials on the second system for the entity, the first system having already updated thereon the first credentials to the second credentials for the entity, the entity thereafter having access to a resource of the first system via the second credentials;
- at the second system, obtaining a record that includes the first credentials based on an identifier included in the request;
- and
- at the second system, updating the first credentials in the record to the second credentials.
Dependencies are inferred from the claim text.