US 2016/0239679 A1Published application

Unified user identification with automatic mapping and database absence handling

AssigneeServiceNow, Inc.

InventorsDemyn Lee Plantenberg, Frank B. Schmuck, Yuri Volobuev

Life of this patent

Estimating the term…

Loading patent…

Abstract

An identification system that may be used in heterogeneous computing environments provides a fail-free path to providing identifiers from a single canonical namespace. Objects or gateways requiring an identifier for access are accessed using an identifier for the canonical namespace. If an entity requests access using an identifier from another namespace, an external database is consulted to determine if a mapping exists for the identifier to another identifier the canonical namespace. If no mapping exists, or the external database is unavailable, then an identifier is automatically generated in the canonical namespace and is used for the access. An internal database is updated with the automatically generated identifier, providing a mechanism to add mappings without administrative intervention. To access resources requiring an identifier from another particular namespace, a canonical namespace identifier may be mapped to another identifier in the particular namespace, or a generic identifier may be used.

Claims9

Dependent claims

A computer-performed method for controlling access to a resource in a computer system, the method comprising:

within the computer system receiving an internal input/output request to access a resource of the computer system, the request including a first identifier associated with an entity, wherein access to the resource requires a security identifier from a canonical namespace;
determining whether or not the first identifier is a member of the canonical namespace containing identifiers used to access resources in the computer system;
responsive to determining that the first identifier is a member of the canonical namespace, accessing the resource using the first identifier;
responsive to determining that the first identifier is not a member of the canonical namespace, whereby the first identifier is determined to not be an identifier that can be used to directly access the resource, determining whether the first identifier has a mapping to a second identifier that is a member of the canonical namespace, wherein the mapping is stored in an internal database;
responsive to determining that the first identifier is not a member of the canonical namespace and does have a mapping to the canonical namespace stored in the internal database, obtaining the second identifier for the entity within the canonical namespace from an entry in the internal database corresponding to the first identifier;
responsive to obtaining the second identifier from the entry in the internal database, accessing the resource using the second identifier;
responsive to determining that the first identifier is not a member of the canonical namespace, and does not have a mapping to the canonical namespace stored in the internal database, automatically generating a third identifier for the entity within the canonical namespace and storing the third identifier in the internal database for further identification of the entity;
and
responsive to generating and storing the third identifier, accessing the resource using the third identifier.

6 more elements

A computer system comprising:

a processor for executing program instructions;
and
a memory coupled to the processor for executing the program instructions, wherein the program instructions include program instructions for controlling access to a resource in the computer system, including
program instructions that receive, within the computer system, an internal input/output request to access a resource, the request including a first identifier associated with an entity, wherein access to the resource requires a security identifier from a canonical namespace,
program instructions that determine whether or not the first identifier is a member of the canonical namespace containing identifiers used to access resources in the computer system,
program instructions that, responsive to determining that the first identifier is a member of the canonical namespace, accessing the resource using the first identifier,
program instructions that, responsive to determining that the first identifier is not a member of the canonical namespace, whereby the first identifier is determined to not be an identifier that can be used to directly access the resource, determine whether the first identifier has a mapping to a second identifier that is a member of the canonical namespace, wherein the mapping is stored in an internal database of the computer system,
program instructions that, responsive to determining that the first identifier is not a member of the canonical namespace and does have a mapping to the canonical namespace stored in the internal database, obtain the second identifier for the entity within the canonical namespace from an entry in the internal database corresponding to the first identifier,
program instructions that, responsive to obtaining the second identifier from the entry in the internal database, access the resource using the second identifier,
program instructions that, responsive to determining that the first identifier is not a member of the canonical namespace and does not have a mapping to the canonical namespace stored in the internal database, automatically generate a third identifier for the entity within the canonical namespace and store the third identifier in the internal database for further identification of the entity, and
program instructions that, responsive to generating and storing the third identifier, accessing the resource using the third identifier.

8 more elements

A computer program product comprising computer-readable memory that is not a signal or a carrier wave storing program instructions for execution within a computer system, wherein the program instructions include program instructions for controlling access to a resource in the computer system, wherein the program instructions comprise program instructions for:

within the computer system, receiving an internal input/output request to access a resource, the request including a first identifier associated with an entity, wherein access to the resource requires a security identifier from a canonical namespace;
determining whether or not the first identifier is a member of the canonical namespace containing identifiers used to access resources in the computer system;
responsive to determining that the first identifier is a member of the canonical namespace, accessing the resource using the first identifier;
responsive to determining that the first identifier is not a member of the canonical namespace, whereby the first identifier is determined to not be an identifier that can be used to directly access the resource, determining whether the first identifier has a mapping to a second identifier that is a member of the canonical namespace, wherein the mapping is stored in an internal database;
responsive to determining that the first identifier is not a member of the canonical namespace and does have a mapping to the canonical namespace stored in the internal database, obtaining the second identifier for the entity within the canonical namespace from an entry in the internal database corresponding to the first identifier;
responsive to obtaining the second identifier from the entry in the internal database, accessing the resource using the second identifier;
responsive to determining that the first identifier is not a member of the canonical namespace and does not have a mapping to the canonical namespace stored in the internal database, automatically generating a third identifier for the entity within the canonical namespace and storing the third identifier in the internal database for further identification of the entity;
and
responsive to generating and storing the third identifier, accessing the resource using the third identifier.

6 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/134,972Filed 21 Apr 2016
Priority: 6 Jan 2014
Published: 18 Aug 2016
Term ends: Not estimatedThe source records don’t support an estimate.

Classification8 codes

G06F 21/45
Authentication, i.e. establishing the identity or authorisation of security principals: structures or tools for the administration of authentication
G06F 16/13
File systems; File servers: file access structures, e.g. distributed indices
G06F 16/245
Querying: query processing
G06F 16/25
Of structured data, e.g. relational data: integrating or interfacing systems involving database management systems

Family

Application14/147,675Continuation · filed 6 Jan 2014
Application15/134,972Continuation
US 10,331,878 B2Related patent
US 2014/0123226 A1Published application
US 9,325,712 B2Related patent
US 2016/0239679 A1This patent

From the US filing history. Foreign family members aren’t listed.