Apparatus and method for managing multiple user identities on a networked computer system

• US 6,981,043 B2
• Filed: 03/27/2001
• Issued: 12/27/2005
• Est. Priority Date: 03/27/2001
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Hahn, Timothy James, Botz, Patrick S., Fleming, Patrick Jerome
• Primary Examiner(s): VU, VIET DUY
• Application Number:
  US09/818,064
• Publication Number:
  US 20020143909A1
• Time in Patent Office: 1,736 Days
• Field of Search: 709/217, 709/223, 709/225, 709/226, 709/227, 709/238, 707/10, 707/100, 707/104
• US Class Current: 709/225
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: Y10S 707/99945 Object-oriented database structure processing
• CPC Class Codes: Y10S 707/99948 Application of database or data structure, e.g. distributed, multimedia, or image

Abstract

An apparatus and method allow a system administrator to manage multiple user identities in multiple user registries in different processing environments. An identity mapping mechanism is provided that includes a directory service that includes entries that reference user identities in the multiple registries, and that reference identity mappings between those entries. The identity mapping mechanism includes an interface defined by a plurality of APIs that allow accessing and correlating the multiple user identities and the identity mappings. A programmer can generate an application or tool that uses the identity mapping mechanism by calling the APIs in the interface. In this manner, administration of user identities occurs with the user as the primary focus, rather than the platform. In addition, a common tool can be used to manage the user identities of different environments, making administration of user identities in a heterogenous network more efficient and cost-effective.

Claims

1. An apparatus comprising:

at least one processor;

a memory coupled to the at least one processor;

first software residing in the memory and executed by the at least one processor, the first software including a first user registry that contains a first user identity for a selected user that is used to authenticate the selected user to the first software;

second software residing in the memory and executed by the at least one processor, the second software including a second user registry that contains a second user identity for the selected user that is used to authenticate the selected user to the second software; and

an identity mapping mechanism that provides a mapping between the first user identity and the second user identity.

2. The apparatus of claim 1 wherein the first user registry comprises a user registry in a first processing environment.

3. The apparatus of claim 2 wherein the second user registry comprises a user registry in a second processing environment that is different than the first processing environment.

4. The apparatus of claim 1 wherein the identity mapping mechanism comprises:

a directory service that contains a plurality of user identity mappings that correlate the first user identity in the first registry to the second user identity in the second registry, and that references the first and second user registries; and

schema for the directory service that specifies relationships between a plurality of entries in the directory service, where at least one entry includes the user identity mappings.

5. The apparatus of claim 4 wherein the directory service comprises Lightweight Directory Access Protocol (LDAP).

6. The apparatus of claim 1 further comprising a global identifier residing in the memory that corresponds to the selected user, and wherein the mapping comprises a first correlation between the first user identity and the global identifier and a second correlation between the second user identity and the global identifier.

7. An apparatus comprising:

at least one processor;

a memory coupled to the at least one processor;

first software residing in the memory and executed by the at least one processor, the first software including a first user registry containing a first plurality of user identities that are used to authenticate users to the first software;

second software residing in the memory and executed by the at least one processor, the second software including a second user registry residing in the memory containing a second plurality of user identities that are used to authenticate users to the second software;

a directory service that contains a plurality of user identity mappings that correlate a first user identity in the first user registry to a second user identity in the second user registry, and that references the first and second user registries; and

schema for the directory service that specifies relationships between a plurality of entries in the directory service, where at least one entry includes the user identity mappings.

8. The apparatus of claim 7 wherein the first user registry comprises a user registry in a first processing environment.

9. The apparatus of claim 8 wherein the second user registry comprises a user registry in a second processing environment that is different than the first processing environment.

10. The apparatus of claim 7 wherein the directory service comprises Lightweight Directory Access Protocol (LDAP).

11. The apparatus of claim 7 further comprising a global identifier residing in the memory that corresponds to the selected user, and wherein the mapping comprises a first correlation between the first user identity and the global identifier and a second correlation between the second user identity and the global identifier.

27. The apparatus of claim 11, wherein the first correlation is a source relationship and wherein the second correlation is a target relationship.

12. A method for managing a plurality of user identities on a plurality of computer systems coupled to a network, each user identity corresponding to a defined processing environment, the method comprising the steps of:

providing an identity mapping mechanism that provides a mapping between a first user identity in a first user registry in first software and a second user identity in a second user registry in second software, wherein the first user identity is used to authenticate a selected user to the first software and the second user identity is used to authenticate the selected user to the second software; and

invoking the identity mapping mechanism to determine the mapping between the first user identity and the second user identity.

13. The method of claim 12 wherein the identity mapping mechanism comprises:

a directory service that contains a plurality of user identity mappings that correlate the first user identity in the first registry to the second user identity in the second registry, and that references the first and second user registries; and

schema for the directory service that specifies relationships between a plurality of entries in the directory service, where at least one entry includes the user identity mappings.

14. The method of claim 13 wherein the directory service comprises Lightweight Directory Access Protocol (LDAP).

15. A method for correlating a plurality of user identities on a plurality of computer systems coupled to a network, the method comprising the steps of:

generating a global identifier corresponding to a user;

mapping a first user identity in a first user registry in first software to the global identifier, wherein the first user identity is used to authenticate a selected user to the first software; and

mapping a second user identity in a second user registry in second software to the global identifier, wherein the second user identity is used to authenticate the selected user to the second software.

16. A program product comprising:

(A) an identity mapping mechanism that provides a mapping between;

(A1) a first user identity for a selected user residing in a first user registry in first software, wherein the first user identity is used to authenticate a selected user to the first software; and

(A2) a second user identity for the selected user residing in a second user registry in second software, wherein the second user identity is used to authenticate a selected user to the second software; and

(B) computer-readable signal bearing media bearing the identity mapping mechanism.

17. The program product of claim 16 wherein the first user registry comprises a user registry in a first processing environment.

18. The program product of claim 17 wherein the second user registry comprises a user registry in a second processing environment that is different than the first processing environment.

19. The program product of claim 16 wherein the identity mapping mechanism comprises:

a directory service that contains a plurality of user identity mappings that correlate the first user identity in the first registry to the second user identity in the second registry, and that references the first and second user registries; and

schema for the directory service that specifies relationships between a plurality of entries in the directory service, where at least one entry includes the user identity mappings.

20. The program product of claim 16 wherein the directory service comprises Lightweight Directory Access Protocol (LDAP).

21. The program product of claim 16 wherein the identity mapping mechanism provides a mapping between the first user identity and the second user identity by creating a global identifier that corresponds to the selected user, and by generating a first correlation between the first user identity and the global identifier and a second correlation between the second user identity and the global identifier.

22. A program product comprising:

(A) a directory service that contains a plurality of user identity mappings that correlate a first user identity in a first user registry in first software to a second user identity in a second user registry in second software, and that references the first and second user registries, wherein the first user identity is used to authenticate a selected user to the first software and the second user identity is used to authenticate the selected user to the second software; and

(B) schema for the directory service that specifies relationships between a plurality of entries in the directory service, where at least one entry includes the user identity mappings; and

(C) computer-readable recordable media media bearing the directory service and the schema.

23. The program product of claim 22 wherein the first user registry comprises a user registry in a first processing environment.

24. The program product of claim 23 wherein the second user registry comprises a user registry in a second processing environment that is different than the first processing environment.

25. The program product of claim 22 wherein the directory service comprises Lightweight Directory Access Protocol (LDAP).

26. The program product of claim 22 wherein the plurality of user identity mappings each comprise a mapping between the first user identity and a global identifier that corresponds to the selected user, and a mapping between the global identifier and the second user identity.