AUTOMATING CLOUD SERVICE RECONNECTIONS

• US 20120304262A1
• Filed: 08/08/2011
• Published: 11/29/2012
• Est. Priority Date: 05/23/2011
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Rao, Guruprakash, Cucco, John B., Rybalka, Veniamin, Dihle, Ulric, Draper, Larry, Agrawal, Kanika, Chan, Tony, Chandra, Ashwin
• Granted Patent: US 8,578,460 B2
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

Technologies are generally described for automatically reconnecting a security principal to cloud services through correlation of security principal identifier attributes. A new security principal for a user may be detected and automatically reconnected to the user'"'"'s cloud based services. An administrator for the security domains may specify a value of a unique security principal metadata attribute for the original security principal in a customizable security principal metadata attribute in the new security principal in the same or new security domain. A secondary verification metadata attribute may optionally be specified to ensure the correct security principal is reconnected to the user'"'"'s cloud based resources. The correlation between the original security principal for the user and the new security principal may be used to reconnect the user'"'"'s cloud resources.

Claims

1. A method executed on a computing device for automatically reconnecting a user to cloud based services, the method comprising:

determining a metadata attribute for a security principal managing access to a cloud based service for a user;

creating a new security principal for the user;

specifying a value of the metadata attribute for the security principal in a customizable metadata attribute in the new security principal;

receiving a request for reconnecting the user to the cloud based service; and

reconnecting the user to the cloud based service using a correlation between the metadata attributes of the security principal and the new security principal.

2. The method of claim 1, wherein the metadata attribute is a unique attribute.

3. The method of claim 2, wherein the metadata attribute is one from a set of:

a global unique identifier (GUID), an email address, an account number, and an employee identifier.

4. The method of claim 1, further comprising:

creating the new security principal in response to deletion of the security principal.

5. The method of claim 4, further comprising:

setting the value of the metadata attribute for the new security principal to be the same as the metadata attribute of the security principal.

6. The method of claim 1, wherein the request for reconnecting the user is in response to a migration of the user to a new security domain from an original security domain.

7. The method of claim 6, further comprising:

upon connecting the user to the new security domain, automatically removing the user'"'"'s cloud based service access from the security principal.

8. The method of claim 1, further comprising:

performing a secondary verification employing another metadata attribute.

9. The method of claim 8, wherein the other metadata attribute is one from a set of a global unique identifier (GUID), an email address, an account number, and an employee identifier, but not the same as the metadata attribute.

10. The method of claim 8, further comprising:

if the secondary verification fails, not connecting the new security principal and leaving the security principal connected to the cloud based services.

11. The method of claim 1, further comprising:

if the security principal is removed from visibility of a security domain, marking the cloud based service of a corresponding user as pending deletion for a customizable period of time.

12. A computing device for managing cloud based services with automatic reconnection, the computing device comprising:

a memory storing instructions; and

a processor executing a security management application in conjunction with the stored instructions, the security management application configured to;

determine a metadata attribute for a security principal managing access to a cloud based service for a user;

create a new security principal for the user;

specify a value of the metadata attribute for the security principal in a customizable metadata attribute in the new security principal;

receive a request for reconnecting the user to the cloud based service in response to one of;

a migration of the user from an original security domain to a new security domain and a deletion of the security principal;

reconnect the user to the cloud based service using a correlation between the metadata attributes of the security principal and the new security principal; and

if the request for reconnecting is in response to the migration of the user to the new security domain, automatically remove the user from the original security domain upon connecting the user to the new security domain.

13. The computing device of claim 12, wherein the security management application is further configured to:

perform a secondary verification employing another metadata attribute, wherein the metadata attributes comprise two distinct ones from a set of;

a global unique identifier (GUID), an email address, an account number, and an employee identifier.

14. The computing device of claim 12, wherein the metadata attributes are specified as strings.

15. The computing device of claim 12, wherein the security management application is part of a hosted service managing the cloud based service.

16. The computing device of claim 12, wherein the request for reconnecting the user is as a result of at least one from a set of:

forest consolidation, information technology organization restructuring, organizational merger, change in employee status, and accidental deletion of the original security principal in a security group.

17. A computer-readable memory device with instructions stored thereon for automatically reconnecting a user to cloud based resources, the instructions comprising:

determining a metadata attribute for a security principal managing access to the cloud based resources for a user;

creating a new security principal for the user that includes at least one metadata attribute based on another metadata attribute of an original security principal for the user at a source security domain;

performing a secondary verification employing a further metadata attribute associated with the original security principal;

receiving a request for reconnecting the user to a destination security domain for the cloud based resources; and

connecting the user to the new security domain based on a correlation between the at least one metadata attribute of the new security principal and the other metadata attribute of the original security principal if the secondary verification is successful.

18. The computer-readable memory device of claim 17, wherein the instructions further comprise:

removing the original security principal from the source security domain without affecting the user'"'"'s access to the cloud based resources.

19. The computer-readable memory device of claim 17, wherein the source security domain and the destination security domain are the same and the user is reconnected to the cloud based resources following an accidental deletion of the original security principal.

20. The computer-readable memory device of claim 17, wherein the original and new security principals are one of:

a user account, a group account, and a computer account assigned permissions to access selected cloud based resources and to perform actions on the cloud based resources.