ONBOARDING RESOURCES TO AN IDENTITY MANAGEMENT SYSTEM

• US 20110016162A1
• Filed: 07/15/2009
• Published: 01/20/2011
• Est. Priority Date: 07/15/2009
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Rouault, Jason, Booth, David, Kisielewicz, Marek, Williams, Stuart, Mukerji, Jishnu
• Granted Patent: US 9,015,204 B2
• Time in Patent Office: Days
• US Class Current: 707/809
• CPC Class Codes: G06F 16/81 Indexing, e.g. XML tags; Data structures therefor; Storage structures
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems

Abstract

A process of onboarding a resource into an identity management system is disclosed. The identity management system is configured to connect users with resources and manage user identities and security entitlements of the connected resources. The process of onboarding a resource includes marking or tagging resource fields with semantic markers.

Claims

1. A method of onboarding a resource in an identity management system, comprising:

marking fields in an object schema of the resource with semantic markers;

mapping the object schema of the resource to one or more provisioning objects of the identity management system profile by matching the markers of the fields of the object schema of the resource with markers of fields of the provisioning objects of the identity management system profile.

2. The method of claim 1 comprising maintaining a catalogue with semantic markers organized to provide at least broader and narrower significance and syntactic composition relations between catalogue concepts;

and wherein the marking of the fields comprises selecting markers from the catalogue.

3. The method of claim 2 wherein the catalogue is expressed as an ontology.

4. The method of claim 3 wherein the ontology is expressed in a resource description framework vocabulary.

5. The method of claim 1 comprising retrieving a native object schema of the resource.

6. The method of claim 1 comprising selecting native objects and object fields of the resource for projection as provisioning objects.

7. The method of claim 6 comprising annotating projected native schema fields by marking with the semantic markers of conveyed values.

8. The method of claim 7 comprising refining annotations to include a narrower significance.

9. The method of claim 7 wherein the provisioning objects are mapped to fields in an identity system profile.

10. The method of claim 4 wherein the mapping includes:

provisioning objects and profile object fields that include matching annotations and directly mapping provisioning object fields to the profile object fields;

searching the catalogue and the objects for profile object fields with a narrower significance;

searching the catalogue for compositions that can be satisfied from the profile object fields.

11. The method of claim 10 wherein any unmapped fields are refined.

12. A computer-readable storage medium storing computer-executable instructions for controlling a computing device in an identity management system onboarding a resource, the computer-executable instructions comprising:

instructions for discovering a schema of the resource and converting the schema to a resource specific ontology;

instructions for selecting schema fields and tagging value significance;

instructions for generating a connector map and a deployment map based on the schema fields and the value significance.

13. The computer-readable storage medium of claim 12 wherein the resource specific ontology is expressed as a resource description framework schemata or a web ontology language.

14. The computer-readable storage medium of claim 12 wherein the instructions for selecting schema fields include instructions for viewing the discovered schema and choosing relevant native schema fields to be managed with the identity management system.

15. The computer-readable storage medium of claim 12 where the instructions for generating the connector map and the deployment map include instructions for saving the connector map and the deployment map into a memory of the identity management system.

16. The computer-readable storage medium of claim 12 wherein the instructions are configured to interface with an owner of the resource and an administrator of the identity management system.

17. The computer-readable storage medium of claim 16 wherein the instructions are implemented as a web-based onboarding tool.

18. An identity management system configured to onboard a resource in an enterprise computing system, comprising:

a computer system having a processor and a memory wherein the computer system is configured to couple a user to a selected resource of the enterprise and to onboard resources;

wherein the resource includes resource fields;

wherein the memory includes a catalogue having semantic markers organized to provide broader and narrower significance and syntactic composition relations between catalog concepts; and

wherein the resource fields are marked with semantic markers of conveyed values.

19. The identity management system of claim 18 including an application utility accessible by an owner of the resource and an administrator of the identity management system to include the memory with a map of a correlation between native object fields of the resource and the identity management system.

20. The identity management system of claim 19 wherein the computer system is coupled to the resource and the user through a network, and wherein the application utility is network based.