Managing user accounts and groups in multiple forests

• US 8,095,629 B2
• Filed: 04/22/2011
• Issued: 01/10/2012
• Est. Priority Date: 05/27/2009
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Ward, Robert D., Ganjeh, Nima, Kjellman, Andreas B. G.
• Primary Examiner(s): WON, MICHAEL YOUNG
• Application Number:
  US13/092,351
• Publication Number:
  US 20110196956A1
• Time in Patent Office: 263 Days
• Field of Search: 709/221, 709/226, 709/249, 709/252, 709/201, 709/213, 709/217, 709/248, 709/250, 719/332, 707/610
• US Class Current: 709/221
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: H04L 63/104 Grouping of entities

Abstract

Methods, systems, and computer program products are provided for managing contact proxies and security proxies in networks that are organized as forests. For instance, contact proxies may be generated to represent user accounts and groups in forests other than the home forests of the user accounts and groups. Security proxy objects may be generated to represent group members (e.g., security principals and groups) in groups in forests other than the home forests of the group members. Furthermore, when both a contact object and a security proxy object exist for a member added to a group, one of the contact object or the security proxy object may be selected to represent the member in the group.

Claims

1. A computer-implemented method, comprising:

receiving an indication that an object is mail-enabled, the mail-enabled object being included in a first forest;

determining one or more forests associated with the first forest;

including the mail-enabled object in a contact set associated with each forest of the determined one or more forests;

generating a contact object for the mail-enabled object; and

including the contact object in a domain of each forest of the determined one or more forests.

2. The method of claim 1, wherein the mail-enabled object is a group or a user account.

3. The method of claim 1, wherein said receiving an indication that an object is mail-enabled comprises:

providing a user interface for a user to add a user account or group as the object that is mail-enabled.

4. The method of claim 1, wherein said determining one or more forests associated with the first forest comprises:

transmitting a request to the first forest for an indication of one or more forests associated with the first forest.

5. The method of claim 1, wherein said determining one or more forests associated with the first forest comprises:

receiving a list of one or more forests associated with the first forest;

wherein said including the mail-enabled object in a contact set associated with each forest of the determined one or more forests comprises;

accessing storage for a plurality of contact sets, each contact set of the plurality of contact sets corresponding to a particular forest in the list,

modifying each of the plurality of contact sets to indicate the mail-enabled object, and

storing the modified plurality of contact sets in the storage.

6. The method of claim 1, wherein said including the contact object in a domain of each forest of the determined one or more forests comprises:

transmitting the contact object to each forest of the determined one or more forests.

7. A multi-forest manager, comprising:

an associated forest list requester configured to determine one or more forests associated with a first forest that includes an object indicated to be mail-enabled;

a contact set modifier configured to include the mail-enabled object in a contact set associated with each forest of the determined one or more forests; and

a contact object generator configured to generate a contact object for the mail-enabled object, and to include the contact object in a domain of each forest of the determined one or more forests.

8. The multi-forest manager of claim 7, wherein the mail-enabled object is a group or a user account.

9. The multi-forest manager of claim 7, further comprising:

a user interface that enables a user to add a user account or group as the object that is mail-enabled.

10. The multi-forest manager of claim 7, wherein the associated forest list requester transmits a request to the first forest for an indication of one or more forests associated with the first forest.

11. The multi-forest manager of claim 7, wherein the associated forest list requester receives a list of one or more forests associated with the first forest;

and

the contact set modifier accesses storage for a plurality of contact sets, each contact set of the plurality of contact sets corresponding to a particular forest in the list, the contact set modifier modifies each of the plurality of contact sets to indicate the mail-enabled object, and the contact set modifier stores the modified plurality of contact sets in the storage.

12. The multi-forest manager of claim 7, wherein the contact object generator transmits the contact object to each forest of the determined one or more forests.

13. A computer program product comprising a computer usable storage device having computer readable logic embodied in said storage medium for enabling a processing unit to perform forest management, comprising:

first means for enabling the processing unit to determine one or more forests associated with a first forest that includes an object indicated to be mail-enabled;

second means for enabling the processing unit to include the mail-enabled object in a contact set associated with each forest of the determined one or more forests;

third means for enabling the processing unit to generate a contact object for the mail-enabled object; and

fourth means for enabling the processing unit to include the contact object in a domain of each forest of the determined one or more forests.

14. The computer program product of claim 13, wherein the mail-enabled object is a group or a user account.

15. The computer program product of claim 13, further comprising:

fifth means for enabling the processing unit to provide a user interface for a user to add a user account or group as the object that is mail-enabled.

16. The computer program product of claim 13, wherein said first means comprises:

means for enabling the processing unit to transmit a request to the first forest for an indication of one or more forests associated with the first forest.

17. The computer program product of claim 13, wherein said second means comprises:

means for enabling the processing unit to access storage for a plurality of contact sets, each contact set of the plurality of contact sets corresponding to a particular forest in a list of one or more forests associated with the first forest,

means for enabling the processing unit to modify each of the plurality of contact sets to indicate the mail-enabled object, and

means for enabling the processing unit to store the modified plurality of contact sets in the storage.

18. The computer program product of claim 13, wherein fourth means comprises:

means for enabling the processing unit to transmit the contact object to each forest of the determined one or more forests.