Syncronization facility for information domains employing dissimilar protective transformations

• US 20040117386A1
• Filed: 08/12/2003
• Published: 06/17/2004
• Est. Priority Date: 12/12/2002
• Status: Abandoned Application

• Current Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Baldwin, Duane, Lavender, Robert Gregory, Kolics, Bertold, Coulbeck, Andrew, Wahl, Mark
• Application Number:
  US10/639,118
• Publication Number:
  US 20040117386A1
• Time in Patent Office: Days
• US Class Current: 707/100
• CPC Class Codes: G06F 21/6236 between heterogeneous systems
• CPC Class Codes: H04L 61/4523 using lightweight directory access protocol [LDAP]
• CPC Class Codes: H04L 61/4552 Lookup mechanisms between a plurality of directories; Synchronisation of directories, e.g. metadirectories
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

Mechanisms have been developed for synchronizing information amongst directory spaces or repositories that employ dissimilar protective transformations. In some exemplary realizations, directory spaces are embodied as directory servers, services or similar components of computer operating systems. In some exemplary realizations, dissimilar protective transformations include differing hashes (or encryption) techniques or facilities employed by products available from Sun Microsystems, Inc., on the one hand, and Microsoft Corporation on another. However, the inventive techniques are not limited thereto. The mechanism is responsive to a change in the second store, invalidating a corresponding entry in the first store. Upon receipt, by the first store, of an authentication request that includes a credential and which corresponds to the invalidated entry, the method chains the authentication request to the second store. If the authentication at the second store is successful, the method updates the previously invalidated entry of the first store with the credential.

Claims

1. A method of synchronizing credentials between first and second stores that employ dissimilar protective transforms, the method comprising:

responsive to a change in the second store, invalidating a corresponding entry in the first store; and

upon receipt, by the first store, of an authentication request that includes a credential and which corresponds to the invalidated entry, chaining the authentication request to the second store and, if successful, updating the previously invalidated entry of the first store with the credential.

2. The method of claim 1,

wherein at least one of the first and second stores is embodied as a directory service.

3. The method of claim 1,

wherein at least one of the first and second stores is embodied as an authentication or access control service.

4. The method of claim 1,

wherein at least the first store is embodied as a service that provides authentication.

5. The method of claim 1,

wherein the updating includes encoding the credential using a first of the dissimilar protective transforms;

and

wherein the updating is performed without reversing a second of the dissimilar protective transforms.

6. The method of claim 1,

wherein at least one of the dissimilar protective transforms is generally irreversible.

7. The method of claim 1,

wherein the change in the second store includes a change of the credential.

8. The method of claim 1,

wherein the change in the second store includes a change of an entry that encodes the credential.

9. The method of claim 1, further comprising:

accessing a change log of the second store to detect the change.

10. The method of claim 1, further comprising:

accessing a change notification service of the second store to detect the change.

11. The method of claim 1, further comprising:

calling an interface of the second store to detect the change.

12. The method of claim 1, further comprising:

intercepting the change and signaling same.

13. The method of claim 1,

wherein the updating includes revising the previously invalidated entry.

14. The method of claim 1,

wherein the updating includes replacing the previously invalidated entry with a valid instance thereof including the credential.

15. The method of claim 1,

wherein the invalidated entry is marked as such using an invalid, non-authoritative or expiry indicator.

16. The method of claim 1,

wherein the invalidated entry encodes the credential.

17. The method of claim 1,

wherein the invalidated entry includes at least a portion of a user or entity record corresponding to the credential.

18. The method of claim 1, further comprising:

causing the change in the second store.

19. The method of claim 1, further comprising:

upon receipt, by the first store, of a second authentication request including a second credential and not corresponding to an invalidated entry, authenticating against the first store and, if unsuccessful, chaining the authentication request to the second store.

20. The method of claim 1,

wherein at least one of the first and second stores is embodied, at least in part, as part of an operating system.

21. The method of claim 1,

wherein the first and second stores reside on a same computer.

22. The method of claim 1,

wherein the first and second stores reside on different computers.

23. The method of claim 1, embodied, at least in part, as a polling agent that detects the change and triggers the invalidating.

24. The method of claim 1, embodied, at least in part, as functionality exercisable by a directory service.

25. The method of claim 1, embodied, at least in part, a computer program product encoded in one or more computer readable media selected from the set of disk, tape or other magnetic, optical or electronic storage medium and a network, wireline, wireless or other communications medium.

26. A method of synchronizing between first and second information domains that employ dissimilar protective transforms, the method comprising:

maintaining a mapping between an entry of the first information domain and an entry of the second information domain;

responsive to detection of a change to one of the mapped entries in the second information domain, marking as invalid at least a corresponding element of the mapped entry of the first information domain; and

upon presentation of information corresponding to the marked element, validating the presented information against the second information domain and, if validated, storing a representation thereof in the first information domain, wherein the validating and the storing employ the dissimilar protective transforms.

27. The method of claim 26, further comprising:

detecting the change.

28. The method of claim 26,

wherein the first and second information domains include directories.

29. The method of claim 26,

wherein the information corresponding to the marked element includes a user password.

30. The method of claim 26,

wherein the information corresponding to the marked element includes a credential.

31. The method of claim 26,

wherein at least one of the dissimilar protective transforms includes encryption.

32. The method of claim 26,

wherein at least one of the dissimilar protective transforms includes a hash.

33. The method of claim 26,

wherein the dissimilar protective transforms employ differing keys.

34. The method of claim 26,

wherein the dissimilar protective transforms employ differing transformations.

35. The method of claim 26,

wherein at least one of the dissimilar protective transforms is generally irreversible.

36. The method of claim 26,

wherein the mapping is represented at least in part using an entity unique identifier stored in the first information domain.

37. The method of claim 26, further comprising:

polling a change log of the second information domain to identify the changed entry.

38. The method of claim 26, further comprising:

calling an interface of the second information domain to identify the changed entry.

39. The method of claim 26, further comprising:

intercepting the change and signaling same.

40. The method of claim 26, embodied, at least in part, as:

a plug-in component of a service corresponding to the first information domain; and

a polling agent that performs the change detection.

41. The method of claim 26, performed without customization of the second information domain.

42. The method of claim 26, embodied, at least in part, a computer program product encoded in one or more computer readable media selected from the set of disk, tape or other magnetic, optical or electronic storage medium and a network, wireline, wireless or other communications medium.

43. A computer program product executable to synchronize a credential encoded by a first service with that encoded by a second service, wherein the first and second service encodings employ dissimilar protective transforms and wherein, for a first service credential encoding mapped to a corresponding second service encoding, the synchronization is performed in response to an invalidity indication for the first service credential encoding.

44. The computer program product of claim 43,

wherein at least one of the first and second services is embodied as a directory authentication or access control service.

45. The computer program product of claim 43,

wherein the synchronization is performed without reversing the protective transform employed by the second service.

46. The computer program product of claim 43,

wherein the invalidity indication is set in response to a change in the second service.

47. The computer program product of claim 43, further comprising:

a polling agent that detects a change in the second service and sets the invalidity indication in response thereto.

48. The computer program product of claim 43,

wherein the mapping is maintained by the first service.

49. The computer program product of claim 43,

wherein the invalidity indication is encoded by first service.

50. The computer program product of claim 43,

wherein the invalidity indication is encoded using one or more of an invalidity, non-authoritative or expiry indictor.

51. A password synchronization facility comprising:

an authentication service that chains to a second service authentication requests corresponding to invalidated entries of the authentication service and, on successful authentication against the second service, updates a corresponding credential encoding of the authentication service; and

a polling agent that detects changes to entries of the second service and triggers invalidation of the corresponding credential encoding of the authentication service.

52. A password synchronization facility of claim 51, further comprising:

the second service.

53. A password synchronization facility comprising:

a polling agent that detects changes to entries of a credential store and triggers invalidation of corresponding credential encodings of an authentication service, thereby causing the authentication service to chain to a second service authentication requests corresponding to invalidated entries and, on successful authentication against the second service, updates a corresponding credential encoding of the authentication service.

54. The password synchronization facility of claim 53, further comprising:

the authentication service.

55. The password synchronization facility of claim 53, further comprising:

the second service.

56. An apparatus comprising:

a first service that employs a different protective transformation than a second service; and

means for synchronizing an invalidated credential encoding of the first service with a credential encoded by a second service without reversing the protective transformation employed by the second service.

57. The apparatus of claim 56, further comprising:

means for invalidating the credential encoding of the first service in correspondence with an update of the credential encoded by the second service.