Toggle between accounts

• US 9,065,818 B2
• Filed: 05/02/2013
• Issued: 06/23/2015
• Est. Priority Date: 05/02/2013
• Status: Active Grant

• Current Assignee: Dropbox, Inc.
• Original Assignee: Dropbox, Inc.
• Inventors: Subramani, Anand, Allain, Francois Alexander
• Primary Examiner(s): Le, David
• Application Number:
  US13/886,222
• Publication Number:
  US 20140331301A1
• Time in Patent Office: 782 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Techniques are described for enabling administrators of teams that use a particular service to specify which sign-on options, of multiple possible sign-on options, are assigned to the members of the teams to which the administrators belong. For example, an administrator may assign a first sign-on option, which only allows users to use native authentication, to one set of members of the team. At the same time, the administrator may assign a second sign-on option, which only allows users to use third-party single-sign-on authentication, to another set of members of the same team.

Claims

1. A method comprising:

providing, by a service, a first mechanism by which users of the service may sign on to the service using native authentication of the service;

providing, by the service, a second mechanism by which users of the service may sign on to the service using a third-party single-sign-on provider;

storing, at the service, data that identifies a plurality of teams;

storing, at the service, data that identifies at least one administrator of each of the plurality of teams;

enabling an administrator of each team of the plurality of teams to access and use a tool to specify which sign-on options, of a plurality of sign-on options made available by the service, are assigned to members of the team to which the administrator belongs;

wherein the plurality of sign-on options include at least;

a first sign-on option in which only the first mechanism may be used; and

a second sign-on option in which only the second mechanism may be used;

wherein the method is performed by one or more computing devices.

2. The method of claim 1 wherein the plurality of sign-on options further includes a third sign-on option in which both the first sign-on option and the second sign-on option may be used.

3. The method of claim 2 wherein:

the plurality of teams includes a particular team that has a particular administrator; and

the third sign-on option applies to the particular administrator.

4. The method of claim 1 wherein:

the plurality of teams includes a particular team with a particular administrator; and

the method further comprises;

receiving, through said tool, input that assigns the first sign-on option to a first member of the particular team; and

receiving, through said tool, input that assigns the second sign-on option to a second member of the particular team while the first member continues to be assigned the first sign-on option.

5. The method of claim 4 wherein:

the first member is one of a first plurality of members of the particular team that are associated with a first role, and the step of receiving input that assigns the first sign-on option to the first member, includes receiving input that assigns the first sign-on option to all members of the particular team that are associated with the first role; and

the second member is one of a second plurality of members of the particular team that are associated with a second role, and the step of receiving input that assigns the second sign-on option to the second member, includes receiving input that assigns the second sign-on option to all members of the particular team that are associated with the second role.

6. The method of claim 1 wherein:

the plurality of teams includes a particular team with a particular administrator; and

the method further comprises providing, by the service, an interface to enable the particular administrator to perform a test to determine whether single-sign-on is configured correctly for a particular member of the particular team.

7. The method of claim 6 wherein the particular member of the particular team is the particular administrator.

8. The method of claim 6 wherein the particular member of the particular team is a member of the particular team other than the particular administrator.

9. The method of claim 6 wherein the interface includes:

a control for receiving, from the administrator, data that indicates an address of a single-sign-on provider;

a control for receiving, from the administrator, data required to authenticate the particular member at the single-sign-on provider; and

a control to initiate the test.

10. The method of claim 9 wherein the interface further comprises an element for indicating whether the test was successful.

11. One or more non-transitory storage media storing instructions which, when executed by one or more computing devices, cause performance of a method comprising the steps of:

providing, by a service, a first mechanism by which users of the service may sign on to the service using native authentication of the service;

providing, by the service, a second mechanism by which users of the service may sign on to the service using a third-party single-sign-on provider;

storing, at the service, data that identifies a plurality of teams;

storing, at the service, data that identifies at least one administrator of each of the plurality of teams;

enabling an administrator of each team of the plurality of teams to access and use a tool to specify which sign-on options, of a plurality of sign-on options made available by the service, are assigned to members of the team to which the administrator belongs;

wherein the plurality of sign-on options include at least;

a first sign-on option in which only the first mechanism may be used; and

a second sign-on option in which only the second mechanism may be used.

12. The one or more non-transitory storage media of claim 11 wherein the plurality of sign-on options further includes a third sign-on option in which both the first sign-on option and the second sign-on option may be used.

13. The one or more non-transitory storage media of claim 12 wherein:

the plurality of teams includes a particular team that has a particular administrator; and

the third sign-on option applies to the particular administrator.

14. The one or more non-transitory storage media of claim 11 wherein:

the plurality of teams includes a particular team with a particular administrator; and

the method further comprises;

receiving, through said tool, input that assigns the first sign-on option to a first member of the particular team; and

receiving, through said tool, input that assigns the second sign-on option to a second member of the particular team while the first member continues to be assigned the first sign-on option.

15. The one or more non-transitory storage media of claim 14 wherein:

the first member is one of a first plurality of members of the particular team that are associated with a first role, and the step of receiving input that assigns the first sign-on option to the first member, includes receiving input that assigns the first sign-on option to all members of the particular team that are associated with the first role; and

the second member is one of a second plurality of members of the particular team that are associated with a second role, and the step of receiving input that assigns the second sign-on option to the second member, includes receiving input that assigns the second sign-on option to all members of the particular team that are associated with the second role.

16. The one or more non-transitory storage media of claim 11 wherein:

the plurality of teams includes a particular team with a particular administrator; and

the method further comprises providing, by the service, an interface to enable the particular administrator to perform a test to determine whether single-sign-on is configured correctly for a particular member of the particular team.

17. The one or more non-transitory storage media of claim 16 wherein the particular member of the particular team is the particular administrator.

18. The one or more non-transitory storage media of claim 16 wherein the particular member of the particular team is a member of the particular team other than the particular administrator.

19. The one or more non-transitory storage media of claim 16 wherein the interface includes:

a control for receiving, from the administrator, data that indicates an address of a single-sign-on provider;

a control for receiving, from the administrator, data required to authenticate the particular member at the single-sign-on provider; and

a control to initiate the test.

20. The one or more non-transitory storage media of claim 19 wherein the interface further comprises an element for indicating whether the test was successful.