Cross-forest sharing

• US 20070106733A1
• Filed: 11/10/2005
• Published: 05/10/2007
• Est. Priority Date: 11/10/2005
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Ramanathan, Rajesh, Costenaro, Daniel, Ashby, Erik
• Granted Patent: US 7,788,328 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/104 Grouping of entities

Abstract

Users from one forest can share PIM data with users from another forest by replicating user account information from one forest into the other forest, including SIDs for each user account (referred to herein as a synchronization process). Using this replicated information, the sharing user wishing to share PIM data across a forest boundary can set a permission to allow the cross-forest user to access the PIM data. The sharing user adds the SID of the cross-forest user to the ACL of the sharing user'"'"'s mailbox. When the cross-forest user wishes to access the PIM data from the sharing user, the cross-forest user'"'"'s PIM application obtains the mailbox identifier information of the sharing user from the user'"'"'s forest. With this mailbox information, the cross-forest user'"'"'s PIM application can then send a request to the sharing user'"'"'s mailbox server to access the PIM data.

Claims

1. A method for sharing a user'"'"'s personal information management (PUM) data with another user across a forest boundary, the method comprising:

obtaining mailbox and security identifier (SID) information for a first user, the first user being part of a first forest;

setting a permission for the first user to access PIM data of a second user, the second user being part of a second forest;

providing identification information for a mailbox of the second user to a PIM application residing in the first forest in response to a request received from the PIM application; and

providing PIM data to the PIM application in response to a request for PIM data from the PIM application, wherein the request is formed using the provided identification information.

2. The method of claim 1 wherein obtaining mailbox and SID information comprises setting a cross-forest trust.

3. The method of claim 1 wherein obtaining mailbox and SID information comprises setting a type property of the first user'"'"'s mailbox and SID information to indicate that the first user can access PIM data.

4. The method of claim 1 wherein an autodiscovery module residing in the second forest provides the identification information for the mailbox.

5. The method of claim 4 wherein identification information for the autodiscovery module residing in the second forest is obtained by the PIM application from an autodiscovery module residing in the first forest.

6. The method of claim 1 wherein setting the permission comprises adding the SID of the first user to an access control list (ACL) of the second user'"'"'s mailbox.

7. The method of claim 6 wherein providing PIM data to the PIM application comprises verifying that the first user'"'"'s SID is listed in the ACL.

8. One or more computer-readable media having stored thereon instructions that when executed by a computer implement the method of claim 1.

9. A system for sharing a user'"'"'s personal information management (PIM) data with another user across a forest boundary, the system comprising:

means for obtaining mailbox and security identifier (SID) information for a first user, the first user being part of a first forest;

means for setting a permission for the first user to access PIM data of a second user, the second user being part of a second forest;

means for providing identification information for a mailbox of the second user to a PIM application residing in the first forest in response to a request received from the PIM application; and

means for providing PIM data to the PIM application in response to a request for PIM data from the PIM application, wherein the request is formed using the provided identification information.

10. The system of claim 9 wherein the means for obtaining mailbox and SID information comprises means for setting a cross-forest trust.

11. The system of claim 9 wherein the means for obtaining mailbox and SID information comprises means for setting a type property of the first user'"'"'s mailbox and SID information to indicate that the first user can access PIM data.

12. The system of claim 9 wherein the means for providing identification information comprises an autodiscovery module residing in the second forest that provides the identification information for the mailbox.

13. The system of claim 12 wherein identification information for the autodiscovery module residing in the second forest is obtained by the PIM application from an autodiscovery module residing in the first forest.

14. The system of claim 9 wherein the means for setting the permission comprises means for adding the SID of the first user to an access control list (ACL) of the second user'"'"'s mailbox.

15. The system of claim 14 wherein the means for providing PIM data to the PIM application comprises means for verifying that the first user'"'"'s SID is listed in the ACL.

16. A system for sharing a user'"'"'s personal information management data with another user across a forest boundary, the system comprising:

a directory server having a synchronization module to obtain mailbox and security identifier (SID) information for a first user, the first user being part of a first forest and the directory server residing in a second forest;

a mailbox server coupled to the directory server to maintain a mailbox for a second user, wherein a second user can set a permission for the first user to access PIM data associated with the second user'"'"'s mailbox, the second user being part of a second forest; and

an autodiscovery module coupled to the exchange server to selectively provide identification information for the second user'"'"'s mailbox to a PIM application residing in the first forest in response to a request received from the PIM application.

17. The system of claim 16 wherein the directory server is further to set a type property of the first user'"'"'s mailbox and SID information to indicate that the first user can access PIM data.

18. The system of claim 16 wherein the autodiscovery module is part of the mailbox server.

19. The system of claim 16 wherein the mailbox server is further to add the SID of the first user to an access control list (ACL) of the second user'"'"'s mailbox.

20. The system of claim 19 wherein the mailbox server is further to verify that the first user'"'"'s SID is listed in the ACL before allowing the first user to access PIM data associated with the second user'"'"'s mailbox.