# US 8,789,157 B2 · Hybrid cloud identity mapping infrastructure > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,789,157 B2 - Document ID: US8789157B2 - Status: Granted - Kind: B2 - Application number: 13/272,924 - Filed: 2011-10-13 - Published: 2013-03-07 - Granted: 2014-07-22 - Earliest claimed: 2011-09-06 - Assignees: eBay Inc. - Applicants: Richard Sinn - Inventors: Richard Sinn - Web page: https://patentgrep.com/patent/US8789157B2 ## CPC - H04L 63/102: {Entity profiles} - G06F 21/41: where a single sign-on provides access to a plurality of computers - G06Q 10/10: Office automation; Time management - H04L 47/70: Admission control; Resource allocation - H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)} - H04L 63/0892: {by using authentication-authorization-accounting [AAA] servers or protocols} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L 63/104: {Grouping of entities} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR ## Abstract In various exemplary embodiments, a system and associated method for providing a hybrid cloud computing environment are disclosed. For example, a system may authorize an enterprise user based on an enterprise identity. Once authenticated, embodiments may use mapping data and a cloud role to determine an identity to use when the enterprise user accesses a cloud. ## Claims ### Claim 1 A system, comprising: at least one processor; a hybrid identity mapper implemented by the at least one processor and configured to: maintain a cloud role associated with an enterprise identity of an enterprise user, the enterprise identity being an entry in an internal cloud directory under a first distinguished name, and maintain hybrid cloud mapping data that maps the enterprise identity of the enterprise user to an identity usable in a public cloud, the hybrid cloud mapping data maps the enterprise identity to the identity based on: the entry being under the first distinguished name, and the first distinguished name being mapped to a second distinguished name in a public cloud directory that corresponds to the identity; an authentication and authorization (AA) server configured to: authenticate the enterprise user based on the enterprise identity, and obtain the cloud role and the hybrid cloud mapping data in response to authenticating the enterprise user; and an administration server configured to allow the enterprise user to access the public cloud using the identity based on the hybrid cloud mapping data. ### Claim 2 (depends on 1) The system of claim 1, wherein the hybrid cloud mapping data further comprises a mapping between an enterprise identity directory and a first cloud identity directory associated with a private cloud. ### Claim 3 (depends on 2) The system of claim 2, wherein the administration server is further configured to allow the enterprise user to access the public cloud based further on the cloud role. ### Claim 4 (depends on 3) The system of claim 3, wherein the cloud role indicates at least one of rights to create an instance of a cloud application, rights to update the instance of the cloud application, and rights to delete the instance of the cloud application. ### Claim 5 (depends on 1) The system of claim 1, wherein the hybrid identity mapper is further configured to synchronize hybrid cloud mapping data with identity management servers associated with the private and public clouds. ### Claim 6 (depends on 1) The system of claim 1, wherein the hybrid cloud mapping data further maps the enterprise identity of the enterprise user to additional identities usable in one or more public clouds or private clouds. ### Claim 7 (depends on 6) The system of claim 6, wherein each of the identities of the additional identities maps to the enterprise identity. ### Claim 8 A computer-implemented method, comprising: authenticating an enterprise user based on an enterprise identity, the enterprise identity being an entry in an internal cloud directory under a first distinguished name; responsive to the authenticating of the enterprise user, obtaining a cloud role associated with the enterprise user and hybrid cloud mapping data that maps the enterprise identity to an identity usable in a public cloud, the hybrid cloud mapping data maps the enterprise identity to the identity based on: the entry being under the first distinguished name, and the first distinguished name being mapped to a second distinguished name in a public cloud directory that corresponds to the identity; and providing the enterprise user access to the public cloud using the identity based on the hybrid cloud mapping data. ### Claim 9 (depends on 8) The computer-implemented method of claim 8, wherein the hybrid cloud mapping data comprises a mapping between an enterprise identity directory and a cloud identity directory associated with a private cloud. ### Claim 10 (depends on 9) The computer-implemented method of claim 9, wherein providing the enterprise user access to the public cloud using the identity is based further on the cloud role. ### Claim 11 (depends on 10) The computer-implemented method of claim 10, wherein the cloud role indicates at least one of rights to create an instance of a cloud application, rights to update the instance of the cloud application, and rights to delete the instance of the cloud application. ### Claim 12 (depends on 8) The computer-implemented method of claim 8, further comprising synchronizing the hybrid cloud mapping data with identity management servers associated with the private and public clouds. ### Claim 13 (depends on 8) The computer-implemented method of claim 8, wherein the hybrid cloud mapping data further maps the enterprise identity of the enterprise user to additional identities usable in one or more public clouds or private clouds. ### Claim 14 (depends on 13) The computer-implemented method of claim 13, wherein each of the identities of the additional identities maps to the enterprise identity. ### Claim 15 A non-transitory machine-readable storage medium storing a set of instructions that, when executed by at least one processor, causes the at least one processor to perform operations comprising: authenticating an enterprise user based on an enterprise identity, the enterprise identity being an entry in an internal cloud directory under a first distinguished name; responsive to the authenticating of the enterprise user, obtaining a cloud role associated with the enterprise user and hybrid cloud mapping data that maps the enterprise identity to an identity usable in a public cloud, the hybrid cloud mapping data maps the enterprise identity to the identity based on: the entry being under the first distinguished name, and the first distinguished name being mapped to a second distinguished name in a public cloud directory that corresponds to the identity; and providing the enterprise user access to the public cloud using the identity based on the hybrid cloud mapping data. ### Claim 16 (depends on 15) The non-transitory machine-readable storage medium of claim 15, wherein the hybrid cloud mapping data comprises a mapping between an enterprise identity directory and a cloud identity directory associated with a private cloud. ### Claim 17 (depends on 16) The non-transitory machine-readable storage medium of claim 16, wherein providing the enterprise user access to the public cloud using the identity is based further on the cloud role. ### Claim 18 (depends on 17) The non-transitory machine-readable storage medium of claim 17, wherein the cloud role indicates at least one of rights to create an instance of a cloud application, rights to update the instance of the cloud application, and rights to delete the instance of the cloud application. ### Claim 19 (depends on 15) The non-transitory machine-readable storage medium of claim 15, further comprising synchronizing the hybrid cloud mapping data with identity management servers associated with the private and public clouds. ### Claim 20 (depends on 15) The non-transitory machine-readable storage medium of claim 15, wherein the hybrid cloud mapping data further maps the enterprise identity of the enterprise user to additional identities usable in one or more public clouds or private clouds.