FEDERATED MANAGEMENT FRAMEWORK FOR CREDENTIAL DATA

• US 20080022379A1
• Filed: 06/28/2006
• Published: 01/24/2008
• Est. Priority Date: 06/28/2006
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: WRAY, JOHN C.
• Granted Patent: US 8,392,587 B2
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems

Abstract

Federated management framework for credential data. The framework permits credential-using applications to provide user interface panels and associated semantics to manage the credentials that are relevant to each application. This framework is suitable for use in a multi-application environment where credentials are shared among each the applications. With this framework, each management user interface associated with one of the applications can have the credentials appear in the interface. Furthermore, the framework can detect when one application'"'"'s management user interface attempts a modification to a credential that will affect another application that has an interest that credential.

Claims

1. A method for using a framework within a computer system to manage credentials associated with a plurality of applications, comprising:

receiving a request to modify a credential;

determining which of the plurality of applications may have an interest in the credential if modified;

notifying each of the interested plurality of applications of the request for modification; and

enabling each of the interested plurality of applications to issue a control action relating to the modification of the credential.

2. The method according to claim 1, further comprising obtaining registrations from each of the plurality of applications that indicate interest in a credential.

3. The method according to claim 2, further comprising maintaining a list of each of the plurality of applications and credentials registered by the applications.

4. The method according to claim 3, wherein the determining of which of the plurality of applications may have an interest in the credential if modified comprises querying the maintained list to find out which applications have registered an interest in the credential.

5. The method according to claim 1, wherein the control action comprises approving the modification, or vetoing the modification or taking a recovery action or issuing a warning panel.

6. The method according to claim 1, further comprising forwarding approved modifications to a credential store.

13. The framework according to claim 1, wherein the credential coordinator further comprises logic configured to forward approved modifications to a credential store.

7. A federated data management framework for use in a computer system that manages credentials associated with a plurality of applications, comprising:

an input component configured to receive a credential modification request from the plurality of applications;

a list containing each of the plurality of applications and the credentials that each application has an interest in; and

a credential coordinator configured to receive the credential modification request and determine from the list which of the plurality of applications may have an interest in the credential if modified, wherein the credential coordinator comprises notification logic configured to notify each of the interested plurality of applications of the request for modification and enabling logic configured to permit each of the interested plurality of applications to issue a control action relating to the modification of the credential.

8. The framework according to claim 7, wherein the input component comprises registration logic configured to permit each of the plurality of applications to register an interest in a credential.

9. The framework according to claim 8, wherein the registration logic is further configured to supply registered credential information to the list.

10. The framework according to claim 7, wherein the input component comprises credential access logic configured to permit each of the plurality of applications to propose credential modifications.

11. The framework according to claim 7, wherein the credential coordinator further comprises query logic configured to query the list to find out which applications have an interest in the credential.

12. The framework according to claim 7, wherein the control action comprises approving the modification, or vetoing the modification or taking a recovery action or issuing a warning panel.

14. A computer-readable medium storing computer instructions for instructing a framework within a computer system to manage credentials associated with a plurality of applications, the computer instructions comprising:

receiving a request to modify a credential;

determining which of the plurality of applications may have an interest in the credential if modified;

notifying each of the interested plurality of applications of the request for modification; and

enabling each of the interested plurality of applications to issue a control action relating to the modification of the credential.

15. The computer-readable medium according to claim 14, further comprising instructions for obtaining registrations from each of the plurality of applications that indicate interest in a credential.

16. The computer-readable medium according to claim 15, further comprising instructions for maintaining a list of each of the plurality of applications and credentials registered by the applications.

17. The computer-readable medium according to claim 16, wherein the determining of which of the plurality of applications may have an interest in the credential if modified comprises instructions for querying the maintained list to find out which applications have registered an interest in the credential.

18. The computer-readable medium according to claim 14, wherein the control action comprises approving the modification, or vetoing the modification or taking a recovery action or issuing a warning panel.

19. The computer-readable medium according to claim 14, further comprising instructions for storing approved modifications in a credential store.

20. A computer data signal medium containing computer instructions fixed to the medium for causing a framework within a computer system to manage credentials associated with a plurality of applications, the computer instructions comprising:

receiving a proposed credential modification request from the plurality of applications;

determining which of the plurality of applications may have an interest in the proposed credential modification;

notifying each of the interested plurality of applications of the proposed credential modification; and

enabling each of the interested plurality of applications to issue a control action relating to the proposed credential modification.