Password synchronization in a sign-on management system

• US 20040260953A1
• Filed: 06/18/2003
• Published: 12/23/2004
• Est. Priority Date: 06/18/2003
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Jamieson, Steve, Torres, Rex George, Sharp, Joseph W., Larsen, Guy Paul, Balakrishnan, Anil, Houser, Christopher Robert
• Granted Patent: US 7,251,732 B2
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations

Abstract

A mechanism that synchronizes passwords maintained for plural domains. A user maintains accounts in two domains. The first and second domains each maintain tables correlating userIDs with passwords, such that the same user'"'"'s password can be different in the different domains. A database stores tables that correlate a given user'"'"'s userID/password combination in the first domain with his corresponding userID/password combination in the second domain. The database is used to sign the user onto one domain when the user is working in the other domain. When the user changes his password in the first domain, the change is reported to the database, so that the database stores the current password. Optionally, the password change may be reported to the second domain, such that the user will have the same password in both domains.

Claims

1. A method of recording a password change comprising:

detecting that a first user of a first domain has changed a first password associated with said first user from a first value to a second value; and

reporting the change of the first password to a database that stores one or more tables that correlate a second user of a second domain with the first user and with the first user'"'"'s associated first password.

2. The method of claim 1, further comprising:

in the first domain, receiving from the first user a request to change the first password from the first value to the second value.

3. The method of claim 1, wherein said reporting act comprising:

reporting the change of the first password to a service that mediates access to the database.

4. The method of claim 1, wherein the one or more tables stored in the database comprise:

a first table that correlates users in the first domain with users in the second domain; and

a second table that correlates users in the second domain with passwords of users in the second domain.

5. The method of claim 4, wherein the method further comprises:

modifying the second table such that the second user is correlated with the second value.

6. The method of claim 1, wherein the second domain associates the second user with a second password, and wherein the method further comprises:

requesting the second domain to change the second user'"'"'s second password to the second value.

7. The method of claim 1, further comprising:

determining that the change of the first password from the first value to the second value is not the result of a replication of a change to a second password associated with the second user.

8. The method of claim 1, wherein the first user and the second user are personas in the first domain and second domain, respectively, for the same person.

9. A system that synchronizes password between a first domain and a second domain, the system comprising:

a detector that detects whether a first password associated with a first user in the first domain has changed from a first value to a second value;

a notifier that notifies a database that said first password has changed to said second value, said database storing one or more tables that correlate the first user with a corresponding second user in the second domain, and with a second password associated with the second user.

10. The system of claim 9, where the one or more tables comprise:

a first table that correlates users in the first domain with said users'"'"' corresponding passwords;

wherein said database, in response to being notified that said first password has been changed to said second value, modifies said first table to correlate the first user with the second value.

11. The system of claim 10, wherein the one or more tables comprise:

a second table that correlates users in the first domain with users in the second domain.

12. The system of claim 9, further comprising:

a dampener that determines whether a change to the first password that has been detected by said detector represents a replication of a change arising in the second domain, and that prevents said notifier from notifying the database of the change if the change represents said replication.

13. The system of claim 9, further comprising:

a replicator that requests that the second domain change the second user'"'"'s password to the second value.

14. The system of claim 9, wherein the replicator uses the database to determine that the second user corresponds to the first user.

15. A computer-readable medium encoded with computer-executable instructions to perform a method of password management, the computer-executable instructions being adapted to perform acts comprising:

receiving notice that a first password associated with a first user in a first domain has changed from a first value to a second value; and

updating a database to reflect that said first password has changed to said second value, said database correlating users in said first domain with users in a second domain.

16. The computer-readable medium of claim 15, the computer-executable instructions being adapted to perform acts further comprising:

receiving a request from a second user in said second domain to access said first domain, said first user and said second user being personas for the same person in said first domain and said second domain, respectively;

consulting the database to obtain the first user'"'"'s password; and

using the first user'"'"'s password to obtain access to the first domain on behalf of the second user.

17. The computer-readable medium of claim 15, the computer-executable instructions being adapted to perform acts further comprising:

requesting that a second password associated with a second user in said second domain be changed to said second value.

18. The computer-readable medium of claim 17, wherein the database correlates said first user with said second user.

19. The computer-readable medium of claim 15, wherein said database stores:

a first table that correlates users in said first domain with users in said second domain; and

a second table that correlates users in said first domain with the corresponding passwords of said users in said first domain.

20. The computer-readable medium of claim 19, wherein said act of updating said database comprises modifying an entry in said second table.

21. The computer-readable medium of claim 15, the computer-executable instructions being adapted to perform acts further comprising:

determining that the change of the first password from the first value to the second value is not a replication of a change that originated in the second domain.

22. The computer-readable medium of claim 15, wherein the computer-executable instructions expose, through a programming interface, methods which permit a component to send a notification of a password change.

23. The computer-readable medium of claim 15, wherein the computer-executable instructions are adapted to perform acts further comprising:

marking as expired a password stored in the database in response to a notification from the second environment that a password expiration or password reset event has occurred in the second environment.

24. The computer-readable medium of claim 23, wherein the computer-executable instructions expose, through a programming interface, one or more methods that permit a component to send a notification of said password expiration or password reset event.