PERSONAS IN APPLICATION LIFECYCLE MANAGEMENT

• US 20140006617A1
• Filed: 06/29/2012
• Published: 01/02/2014
• Est. Priority Date: 06/29/2012
• Status: Active Grant

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: VCE Company, LLC (Dell Technologies Inc.)
• Inventors: Lakshman, T.K., Kirchhofer, Richard, Musteata, Oleg, Mahapatra, Akshaya, Popuri, Radha
• Granted Patent: US 9,363,270 B2
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: G06F 9/4451 User profiles; Roaming
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

A user management construct, referred to as a persona, is provided to enable a flexible mechanism that grants elevated or administrative privileges to users, such as application developers. Developers may utilize the privileges bestowed by a persona to execute tasks that normally requires access by traditional information (IT) roles, such as IT administrators, to deploy applications in a cloud computing environment. The tasks may include the provisioning of virtual or physical computing resources and/or the configuration of compute, storage, and networking resources.

Claims

1. A method for managing administrative access to a computing platform having a plurality of tiered computing components, the method comprising:

generating a plurality of personas, each of which defines a different set of administrative tasks that a user having the persona is permitted to carry out; and

selecting one of the personas to be associated with a user to allow the user to carry out the set of administrative tasks defined by the persona.

2. The method of claim 1, further comprising:

selecting another one of the personas to be associated with another user to carry out the set of administrative tasks defined by the another persona.

3. The method of claim 1, wherein the user is associated with the selected persona for a predefined period of time.

4. The method of claim 3, further comprising:

configuring the predefined period of time for each of the personas.

5. The method of claim 1, wherein the set of administrative tasks executed by the user persists for a predefined period of time.

6. The method of claim 1, further comprising:

registering one or more administrative credentials for executing administrative commands on the plurality of tiered computing components.

7. The method of claim 1, further comprising:

determining a group of platform administrators comprised of users authorized to configure the plurality of personas; and

determining a group of platform users comprised of users authorized to perform administrative tasks on the tiered computing components without knowledge of administrative credentials for the tiered computing components.

8. The method of claim 1, wherein the persona comprises a federated identity for a group of users having a time-limited administrative privileges on one or more of the plurality of tiered computing components.

9. A method for carrying out administrative access to a computing platform having a plurality of tiered computing components, the method comprising:

receiving a request from a user to carry out an administrative task;

determining if the user is permitted to carry out the administrative task based on whether the user is associated with a persona that defines a set of administrative tasks that can be carried out by users associated therewith, wherein the administrative task requested by the user is in the set; and

responsive to determining the user is permitted to carry out the administrative task, issuing commands to execute the administrative task.

10. The method of claim 9, further comprising:

determining at least one administrative credential for executing the administrative task on one of the tiered computing components.

11. The method of claim 9, further comprising:

upon expiry of a time interval associated with the persona, terminating execution of the administrative task requested by the user.

12. The method of claim 9, wherein the persona comprises a federated identity for a group of users having a time-limited administrative privileges on one or more of the plurality of tiered computing components.

13. A computer-readable storage medium storing instructions that, when executed by a processor, performs an operation for allocating computer resources in a virtualized environment, the operation comprising:

receiving a request from a user to carry out an administrative task;

determining if the user is permitted to carry out the administrative task based on whether the user is associated with a persona that defines a set of administrative tasks that can be carried out by users associated therewith, wherein the administrative task requested by the user is in the set; and

responsive to determining the user is permitted to carry out the administrative task, issuing commands, to execute the administrative task.

14. The computer-readable storage medium of claim 13, wherein the instructions further comprise instructions for:

determining at least one administrative credential for executing the administrative task on one of the tiered computing components.

15. The computer-readable storage medium of claim 13, wherein the instructions further comprise instructions for:

terminating execution of the administrative task requested by the user upon expiry of a time interval associated with the persona.

16. The computer-readable storage medium of claim 13, wherein the persona comprises a federated identity for a group of users having a time-limited administrative privileges on one or more of the plurality of tiered computing components.