US 9,313,193 B1Granted

Management and authentication in hosted directory service

AssigneeAmazon Technologies, Inc.

InventorsGaurang Pankaj Mehta, Neelam Satish Agrawal, Lawrence Hun-Gi Aung, Guruprakash Bangalore Rao, Shuo Wang, Sameer Palande, Krithi Rai, Chirag Pravin Pandya

Life of this patent

Estimating the term…

patentgrep

Loading patent…

Abstract

A user, group, and device management and authentication system allows administrators to manage one or more directories with devices that are not associated with a domain of the one or more directories via a set of APIs. The system also allows applications and services that do not have direct access to a list of directory users to access the one or more directories. The user, group, and device management and authentication system may be an add-on system that works in conjunction with a centrally-managed directory service to provide such functionality. For example, the system may generate an access token associated with a particular directory that can be used by a service accessed by an administrator to call an API provided by the system. The API call may be translated into a directory-specific API call that can be used to perform an action in the particular directory.

Claims13

Dependent claims

A system comprising:

a plurality of computing systems, wherein each computing system hosts a different directory in a plurality of directories;
and
a computing resource service provider system comprising one or more computing devices, the computing resource service provider system in communication with the plurality of computing systems, the one or more computing devices configured to execute instructions that cause the computing resource service provider system to:
receive, from a user device, a credential, a client identification, and a directory identifier, wherein the directory identifier identifies a first directory in the plurality of directories, and wherein the client identification is associated with a service that is not associated with the first directory;
determine, by a first computing agent associated with the first directory, whether the credential can be authenticated;
and
in response to a determination that the credential can be authenticated,
generate an authentication code,
transmit the authentication code to the user device,
instruct the user device to access the service associated with the client identification,
receive the authentication code from the service associated with the client identification,
generate, in response to receiving the authentication code from the service associated with the client identification, an access token based on the authentication code and the directory identifier,
generate, in response to receiving the authentication code from the service associated with the client identification, a refresh token,
map the access token to the first directory and store the mapping in a database, and
transmit the access token and the refresh token to the service associated with the client identification, wherein the access token allows the user device to manage the first directory via the service associated with the client identification.

12 more elements

A computer-implemented method of authenticating an administrator for the management of one or more directories, the method comprising:

as implemented by a computer resource service provider system comprising one or more computing devices, the computer resource service provider system in communication with a plurality of directories, the computer resource service provider system configured with specific executable instructions,
receiving, from a user device, a credential and a directory identifier, wherein the directory identifier identifies a first directory in the plurality of directories, and wherein the user device accessed a first service that is not associated with the first directory;
determining whether the credential can be authenticated;
generating, in response to a determination that the credential can be authenticated, an authentication code;
transmitting the authentication code to the user device;
instructing the user device to access the first service;
receiving the authentication code from the first service accessed by the user device;
generating, in response to receiving the authentication code from the first service, an access token based on the authentication code and the directory identifier;
generating, in response to receiving the authentication code from the first service, a refresh token;
mapping the access token to the first directory and storing the mapping in a database;
and
transmitting the access token and the refresh token to the first service accessed by the user device, wherein the access token allows the user device to manage the first directory via the first service accessed by the user device.

9 more elements

A non-transitory computer storage system comprising a non-transitory storage device, said computer storage system having stored thereon executable program instructions that direct a computer system to at least:

receive, from a user device, a credential and a directory identifier, wherein the directory identifier identifies a first directory in a plurality of directories, and wherein the user device is not associated with any domain of the first directory;
determine whether the credential can be authenticated;
generate, in response to a determination that the credential can be authenticated, an authentication code;
transmit the authentication code to the user device;
instruct the user device to access a first service;
receive the authentication code from the first service accessed by the user device in response to a request for an access token to manage the first directory;
generate, in response to receiving the authentication code from the first service, the access token based on the authentication code and the directory identifier;
generate, in response to receiving the authentication code from the first service, a refresh token;
map the access token to the first directory and store the mapping in a database;
and
transmit the access token and the refresh token to the first service accessed by the user device, wherein the access token allows the user device to manage the first directory via the first service.

8 more elements

Dependencies are inferred from the claim text.

Facts

Application: 14/500,865Filed 29 Sep 2014
Granted: 12 Apr 2016
Term ends: Not estimatedThe source records don’t support an estimate.

Classification13 codes

H04L 63/0853
For authentication of entities: using an additional device, e.g. smartcard, SIM or a different communication terminal
G06F 16/24
Of structured data, e.g. relational data: querying
G06F 21/6218
Protecting access to data via a platform, e.g. using keys or access control rules: to a system of files or objects, e.g. local or distributed file…
H04L 63/06
Network architectures or network communication protocols for network security: for supporting key management in a packet data network