Security Synchronization Services

• US 20090007260A1
• Filed: 06/29/2007
• Published: 01/01/2009
• Est. Priority Date: 06/29/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Gullickson, Brian Keith, Winje, Paul, Isley, Michael J., Swenson, Grant Eric
• Granted Patent: US 8,032,935 B2
• Time in Patent Office: Days
• US Class Current: 726/21
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems

Abstract

As a result of the inability to assign security in multiple applications at one time, there is an opportunity to tie the disparate security systems together. Security synchronization services is a method and apparatus that uses roles to provide a common administration experience for all applications that use it and fits better for new applications.

Claims

1. A method of synchronizing security settings across a plurality of computer applications comprising:

obtaining authority to modify one or more roles for a user in one or more applications;

collecting roles in each of the applications;

selecting a user;

selecting an application from the plurality of applications;

adjusting a role from the collected roles for the user in the selected application;

if a synchronization rule is related to the adjusted role, executing the synchronization rule wherein the synchronization rule adjusts a role for the user in one or more additional applications.

2. The method of claim 1, wherein the adjustment is one selected from a group comprising grant, change or remove.

3. The method of claim 1, further comprising obtaining a scope of the roles from the application and if the application supports scope specific roles, adjusting the scope specific roles for the user.

4. The method of claim 1, further comprising querying a directory for all users and allowing the user to be selected from the found users.

5. The method of claim 1, further comprising adjusting the role for multiple users at the same time.

6. The method of claim 1, further comprising adding the user to the roles of another user.

7. The method of claim 1, further comprising creating a rule that if the user is assigned a role in a first application, assigning a role in a second application.

8. The method of claim 7, further comprising using web services to execute the rules.

9. The method of claim 8, further comprising storing the rules as XML files.

10. A user interface for a method of synchronizing security settings across a plurality of computer applications comprising a display for:

displaying a user selection interface where a user is entered;

displaying a list of applications;

displaying an application selection interface where an application is selected from the displayed list of applications;

displaying a list of roles in the application;

displaying a role selection interface where a role is selected from the displayed list of roles for the entered user thereby adjusting the selected role for the user in the selected application;

if a synchronization rule is related to the adjusted role,

displaying the synchronization rule wherein the synchronization rule adjusts a role for the entered user in one or more additional applications; and

displaying a rule synchronization interface where the synchronization rule is selected to be executed.

11. The user interface of claim 10, wherein the displayed adjustments are one selected from a group comprising grant, change or remove.

12. The user interface of claim 10, further comprising:

if the application supports scope specific roles,

displaying a scope of the roles from the selected application;

displaying a scope of roles selection interface where a scope is selected from the displayed scope thereby adjusting the scope specific roles for the selected user.

13. The user interface of claim 10, further comprising

displaying a directory of all users;

and

displaying a user selection interface where the user is entered from the found users.

14. The user interface of claim 10, further comprising displaying an option to select multiple users and adjust the role for selected multiple users at the same time.

15. The user interface of claim 10, further comprising displaying an option to add the selected user to the roles of another user.

16. The user interface of claim 10, further comprising:

displaying a role in a first application;

displaying a plurality of roles in a second application;

displaying a user interface where the role in the second application such that the role in the first application is equivalent to the role in the second application thereby creating a rule of role equivalence between the role in the first application and the selected role in the second application.

17. A computer system comprising a processor physically configured in accordance with computer executable instructions, a memory for assisting the processor and an input/output circuit, the computer executable instruction comprising instructions for synchronizing security settings across a plurality of computer applications wherein the instructions comprise instructions for:

obtaining authority to modify one or more role for a user in one or more applications;

collecting roles in each of the applications;

querying a directory for all users and storing the user query results;

selecting a user from the user query results;

selecting an application from the plurality of applications;

adjusting a role from the collected roles for the user in the selected application wherein the adjustment is one selected from a group comprising grant, change or remove;

obtaining a scope of the roles from the application and if the application supports scope specific roles, adjusting the scope specific roles for the user; and

if a synchronization rule is related to the adjusted role, executing the synchronization rule wherein the synchronization rule adjusts a role for the user in one or more additional applications.

18. The computer system of claim 17, further comprising computer executable instructions for creating a rule that if the user is assigned a role in a first application, assigning a role in a second application.

19. The computer system of claim 17, further comprising computer executable instructions for storing the rules as XML files.

20. The computer system of claim 17, further comprising computer executable instructions for using web services to execute the rules.