Method for managing shared accounts in an identity management system

An identity management apparatus, comprising:

• a processor;
• and
• computer memory holding computer instructions that, when executed by the processor, perform a method comprising:
• designating a role to represent an entitlement to a shared account, wherein a shared account is an account that has an associated account credential that is adapted to be shared concurrently among all users authorized to have access to the account;
• authorizing access to the shared account for a new user by assigning the role to the new user;
• and
• in response to a change by an account owner of a password for the shared account, automatically generating and distributing to a single sign-on (SSO) system a shared account credential, the shared account credential adapted to be stored in the single sign-on system to enable the group of users, including the new user, to access the shared account without exposing the shared account credential to the group users.

A computer program product in a non-transitory computer readable medium for use in a data processing system, the computer program product holding computer program instructions which, when executed by the data processing system perform a method, comprising:

• designating a role to represent an entitlement to a shared account, wherein a shared account is an account that has an associated account credential that is adapted to be shared concurrently among all users authorized to have access to the account;
• authorizing access to the shared account for a new user by assigning the role to the new user;
• and
• in response to a change by an account owner of a password for the shared account, automatically generating and distributing to a single sign-on (SSO) system a shared account credential, the shared account credential adapted to be stored in the single sign-on system to enable the group of users, including the new user, to access the shared account without exposing the shared account credential to the group users.

An identity management system, comprising:

• an enterprise single sign-on (E-SSO) server;
• an identity manager server that administers E-SSO user accounts on the E-SSO server, the identity manager server including an interface through which (i) a shared role is designated to represent an entitlement to a shared account and (ii) the shared role is assigned to a user, wherein a shared account is an account that has an associated account credential that is adapted to be shared concurrently among all users authorized to have access to the account;
• and
• an adapter associated with the E-SSO server that responds to a change by an account owner of a password for the shared account to automatically generate and distribute to the E-SSO user accounts on the E-SSO server a shared account credential.