Identity pool bridging for managed directory services

• US 9,736,159 B2
• Filed: 12/05/2013
• Issued: 08/15/2017
• Est. Priority Date: 11/11/2013
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Shah, Shon Kiran, Rao, Guruprakash Bangalore, Rizzo, Thomas Christopher, Mehta, Gaurang Pankaj
• Primary Examiner(s): Pwu, Jeffrey
• Assistant Examiner(s): CORUM JR, WILLIAM A
• Application Number:
  US14/098,298
• Publication Number:
  US 20150135272A1
• Time in Patent Office: 1,349 Days
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/025 for remote control or remote monitoring of applications

Abstract

A customer of a computing resource service provider may utilize a set of credentials to request creation of an identity pool within a managed directory service. Accordingly, the managed directory service may create the identity pool. Instead of having the customer create a separate account within this identity pool, the managed directory service may create a shadow administrator account within the identity pool, which may be used to manage other users and resources in the identity pool within the managed directory service. The managed directory service further exposes an application programming interface command that may be used to obtain a set of credentials for accessing the shadow administrator account. The customer may use this command to receive the set of credentials and access the shadow administrator account. Accordingly, the customer can manage users and resources in the identity pool within the managed directory service.

Claims

1. A computer-implemented method,

comprising:

under the control of one or more computer systems configured with executable

instructions,

enabling a user to utilize a set of credentials to access an interface provided by a computing resource service provider to access a managed directory service;

receiving, at the computing resource service provider, a request from the user to create an identity pool within the managed directory service of the computing resource service provider, the first request comprising information based at least in part on the set of credentials and the identity pool comprising user profiles of one or more other users of the managed directory service and directory policies defining, for each user of the one or more other users, a level of access to a directory within the managed directory service and to applications managed in the directory;

creating, at the managed directory service, the identity pool and a shadow administrative account within the identity pool, the shadow administrative account usable for managing the user profiles of the one or more other users of the managed directory service and the directory policies for defining the level of access to the directory and to the applications managed in the directory for individual users of the directory;

transmitting, through the computing resource service provider and to the managed directory service, an application programming interface command from the user to obtain a directory token for accessing the shadow administrative account, the application programming interface command made available to the user by the managed directory service;

receiving the directory token from the managed directory service; and

enabling the user to utilize the received directory token to perform actions within

the directory.

2. The computer-implemented method of claim 1, wherein the shadow administrative account is further usable to manage access to one or more resources in the directory within the managed directory service.

3. The computer-implemented method of claim 1, wherein enabling the user to utilize the set of credentials to access the interface provided by the computing resource service provider to access the managed directory service is contingent on verifying, at an identity management service provided by the computing resource service provider, that the user is authorized to access the managed directory service.

4. The computer-implemented method of claim 1, wherein the user can delegate access to the managed directory service to other users by defining, at an identity management service provided by the computing resource service provider, one or more policies for the other users.

5. The computer-implemented method of claim 1, wherein the user is a principal within an identity management service identity pool, the identity management service identity pool usable for managing access to one or more services of the computing resource service provider.

6. The computer-implemented method of claim 1, further comprising, in response to creation of the identity pool and the shadow administrator account, enabling the application programming interface command to become usable by the user within the computing resource service provider to cause the managed directory service to transmit the directory token to the user.

7. A computer system,

comprising:

one or more processors; and

memory having collectively stored therein instructions that, when executed by the computer system, cause the computer system to;

authenticate a requestor utilizing credential information for accessing one or more services provided by a computing resource service provider;

receive, from the requestor, a request to create an identity pool within a managed directory service provided by the computing resource service provider, the access to the managed directory service based at least in part on the credential information and the identity pool comprising user accounts of one or more users of the managed directory service and directory policies defining, for each user of the one or more users, a level of access to a directory within the managed directory service and to applications managed in the directory;

create the identity pool within the managed directory service and an account usable by the requestor within the created identity pool, the account usable for managing user profiles of the one or more users and the directory policies; and

enable the requestor to access, by transmitting an application programming interface command to the computer system, the account from within the managed directory service, the application programming interface command made available to the user by the managed directory service.

8. The computer system of claim 7, wherein the creation of the identity pool and the account results in the managed directory service making the application programming interface command callable to cause requests to be transmitted to the managed directory service to obtain directory credential information for accessing the account from within the managed directory service.

9. The computer system of claim 8, wherein to enable the requestor to access the account includes to:

transmit, through the computing resource service provider and to the managed directory service, the application programming interface command from the requestor to obtain directory credential information for accessing the account;

receive the directory credential information from the managed directory service; and

provide the received directory credential information to the requestor.

10. The computer system of claim 7, wherein the requestor is a principal within an identity management service identity pool, the identity management service identity pool usable for managing access to the one or more services provided by the computing resource service provider.

11. The computer system of claim 10, wherein the requestor can delegate access to the managed directory service to other users by defining one or more policies for the other users within the identity management service.

12. The computer system of claim 7, wherein the account is usable to manage access to one or more resources in a directory within the managed directory service.

13. The computer system of claim 12, wherein the one or more resources in the directory include one or more groups of the managed directory service, one or more policies and the applications managed in the directory.

14. A non-transitory computer-readable storage medium having collectively stored thereon executable instructions that, when executed by one or more processors of a computer system, cause the computer system to at least:

verify a requestor utilizing credential information to access one or more services provided by a computing resource service provider is authorized to access a managed directory service provided by the computing resource service provider;

receive, from the requestor, a request to create an identity pool within the managed directory service, the identity pool usable to manage user accounts of one or more users of the managed directory service and directory policies defining, for each user of the one or more users, a level of access to a directory within the managed directory service and to applications managed in the directory;

create the identity pool within the managed directory service and an account usable by the requestor within the created identity pool, the account usable for managing user profiles of the one or more users of the managed directory service and the directory policies; and

enable the requestor to access, by transmitting an application programming interface command to the computer system, the account from within the managed directory service, the application programming interface command made available to the user by the managed directory service.

15. The non-transitory computer-readable storage medium of claim 14, wherein the creation of the identity pool and the account results in the managed directory service making the application programming interface command callable to cause requests to be transmitted to the managed directory service to obtain directory credential information for accessing the account from within the managed directory service.

16. The non-transitory computer-readable storage medium of claim 15, wherein to enable the requestor to access the account includes to:

transmit, through the computing resource service provider and to the managed directory service, the application programming interface command from the requestor to obtain directory credential information for accessing the account;

receive the directory credential information from the managed directory service;

and

provide the received directory credential information to the requestor.

17. The non-transitory computer-readable storage medium of claim 14, wherein the requestor is a principal within an identity management service identity pool, the identity management service identity pool usable for managing access to the one or more services provided by the computing resource service provider.

18. The non-transitory computer-readable storage medium of claim 17, wherein the requestor can delegate access to the managed directory service to other users by defining one or more policies for the other users within the identity management service.

19. The non-transitory computer-readable storage medium of claim 14, wherein the account is usable to manage access to one or more resources of the directory within the managed directory service.

20. The non-transitory computer-readable storage medium of claim 19, wherein the one or more resources include one or more groups of the managed directory service, one or more policies, and the applications managed in the directory.