Generating And Changing Credentials Of A Service Account

• US 20090320108A1
• Filed: 06/20/2008
• Published: 12/24/2009
• Est. Priority Date: 06/20/2008
• Status: Active Grant

• Current Assignee: ServiceNow Incorporated
• Original Assignee: Microsoft Corporation
• Inventors: Roussel, Corey Michael, Yu, Chong, Livingston, Sean Lamont Grant
• Granted Patent: US 8,060,920 B2
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: H04L 63/0846 using time-dependent-passwords, e.g. periodically changing passwords
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying

Abstract

Technologies are described herein for generating and changing credentials of a service account. In one method, a credential schedule is retrieved. The credential schedule specifies when a plurality of credentials are scheduled to be changed. A determination is made whether a current credential associated with the service account is scheduled to be changed according to the credential schedule. Upon determining that the current credential is scheduled to be changed, at least part of a new credential is generated. The current credential is replaced with the new credential for the service account.

Claims

1. A method for generating and changing a credential for a service account, comprising:

retrieving a credential schedule specifying when a plurality of credentials are scheduled to be changed;

determining whether a current credential associated with the service account is scheduled to be changed according to the credential schedule;

upon determining that the current credential is scheduled to be changed, generating at least part of a new credential; and

replacing the current credential with the at least part of the new credential for the service account.

2. The method of claim 1, wherein replacing the current credential with the new credential for the service account comprises resetting a service associated with the service account, and wherein resetting the service causes the service to utilize the new credential instead of the current credential.

3. The method of claim 1, wherein the service comprises a hosted service provided through an enterprise server computer application.

4. The method of claim 1, wherein replacing the current credential with the new credential for the service account comprises:

replacing the current credential with the new credential at a first server computer hosting the service associated with the service account; and

transmitting the new credential to a second server computer for storage in a configuration database, the configuration database containing a plurality of credentials associated with a plurality of service accounts.

5. The method of claim 4, further comprising:

generating a timer job specifying when a second server computer is scheduled to retrieve the new credential from the configuration database, the new credential for replacing the current credential at the second server computer; and

transmitting the timer job to the second server computer.

6. The method of claim 1, wherein the current credential and the new credential each comprise a username and a password.

7. The method of claim 1, wherein generating at least part of a new credential comprises generating a password through a random password generator.

8. The method of claim 1, wherein replacing the current credential with the at least part of the new credential for the service account comprises:

transitioning a service from a first server computer utilizing the current credential to a second server computer utilizing an alternate credential;

upon transitioning the service hosted at a first server computer to the second server computer, replacing the current credential with the new credential at the first server computer;

resetting the service at the first server computer causing the service to utilize the new credential instead of the current credential;

upon resetting the service, testing whether the service is properly operating utilizing the new credential; and

upon determining that the service is properly operating utilizing the new credential, transitioning the service from the second server computer utilizing the alternate credential to the first server computer utilizing the new credential.

9. The method of claim 8, further comprising upon determining that the service is not properly operating utilizing the new credential, replacing the new credential with the current credential at the first server computer.

10. A method for generating and changing a credential for a service account, the service account being associated with a service hosted at a first server computer, the service utilizing a current credential to access shared data, the method comprising:

retrieving, from a configuration database over a network, a credential schedule specifying when a plurality of credentials are scheduled to be changed;

determining whether the current credential is scheduled to be changed according to the credential schedule;

upon determining that the current credential is scheduled to be changed, generating at least part of a new credential;

replacing the current credential with the at least part of the new credential at the first server computer; and

transmitting the new credential over the network to the configuration database, the configuration database adapted to store the plurality of credentials for a plurality of service accounts.

11. The method of claim 10, further comprising:

adjusting global settings associated with a plurality of server computers utilizing the new credential; and

adjusting local settings associated with the first server computer utilizing the new credential.

12. The method of claim 10, further comprising:

generating a timer job specifying when a second server computer is scheduled to retrieve the new credential from the configuration database, the new credential for replacing the current credential at the second server computer; and

transmitting the timer job to the second server computer.

13. The method of claim 10, wherein generating at least part of a new credential comprises generating a username and a password.

14. The method of claim 10, wherein replacing the current credential with the at least part of the new credential at the first server computer comprises:

transitioning a service from the first server computer utilizing the current credential to a second server computer utilizing an alternate credential;

upon transitioning the service hosted at the first server computer to the second server computer, replacing the current credential with the new credential at the first server computer;

resetting the service at the first server computer causing the service to utilize the new credential instead of the current credential;

upon resetting the service, testing whether service is properly operating utilizing the new credential; and

upon determining that the service is properly operating utilizing the new credential, transitioning the service from the second server computer utilizing the alternate credential to the first server computer utilizing the new credential.

15. The method of claim 14, further comprising upon determining that the service is not properly operating utilizing the new credential, replacing the new credential with the current credential at the first server computer.

16. A computer-readable medium having computer-executable instructions stored thereon which, when executed by a computer, cause the computer to:

retrieve a credential schedule specifying when a plurality of credentials are scheduled to be changed, the plurality of credentials being associated with a plurality of service accounts;

determine whether a current credential associated with a service account is scheduled to be changed according to the credential schedule;

upon determining that the current credential is scheduled to be changed, generate at least part of a new credential;

replace the current credential with the at least part of the new credential for the service account; and

resetting a service associated with the service account, wherein resetting the service causes the service to utilize the new credential instead of the current credential.

17. The computer-readable medium of claim 16, wherein to replace the current credential with the new credential for the service account, the computer-executable instructions stored thereon which, when executed by a computer, cause the computer to:

replace the current credential with the new credential at a first server computer hosting the service associated with the service account; and

transmit the new credential to a configuration database, the configuration database containing the plurality of credentials associated with the plurality of service accounts.

18. The computer-readable medium of claim 16 having further computer-executable instructions stored thereon which, when executed by a computer, cause the computer to:

generate a timer job specifying when a second server computer is scheduled to retrieve the new credential from the a configuration database, the new credential for replacing the current credential at the second server computer; and

transmit the timer job to the second server computer.

19. The computer-readable medium of claim 16, wherein to replace the current credential with the at least part of the new credential for the service account, the computer-executable instructions stored thereon which, when executed by a computer, cause the computer to:

transition a service from a first server computer utilizing the current credential to a second server computer utilizing an alternate credential;

upon transitioning the service hosted at a first server computer to the second server computer, replace the current credential with the new credential at the first server computer;

reset the service at the first server computer causing the service to utilize the new credential instead of the current credential;

upon resetting the service, test whether service is properly operating utilizing the new credential; and

upon determining that the service is properly operating utilizing the new credential, transition the service from the second server computer utilizing the alternate credential to the first server computer utilizing the new credential.

20. The computer-readable medium of claim 19 having further computer-executable instructions stored thereon which, when executed by a computer, cause the computer to upon determining that the service is not properly operating utilizing the new credential, replace the new credential with the current credential at the first server computer.