Patent ID: 9380076
Filing Date: 2016-06-28
CPC Classification: H04L

Claim Text:
1. A method of operating a computer as a fulfillment server in an access management system managing access-control records at endpoint computer systems, the access-control records describing rights and restrictions of users with respect to resources of the endpoint computer systems and being used by access-control mechanisms of the endpoint computer systems to enforce the rights and restrictions, the method comprising: executing computer program instructions, by a processor, to form a set of connectors, the connectors being communicatively coupled to respective endpoint computer systems and being structured and operative to translate change requests provided to the connectors into corresponding transactions with the endpoint computer systems, the transactions using system management protocols native to the respective endpoint computer systems to modify the access-control records of the endpoint computer systems according to contents of the transactions; periodically engaging, by the processor, in fulfillment polling communications with an access management server of the access management system, the access management server maintaining a database of active change requests describing modifications to be made to the access-control records, the fulfillment polling communications including request messages sent from the fulfillment server to the access management server and corresponding response messages sent from the access management server to the fulfillment server, the request messages requesting retrieval of active change requests from the database and the response messages containing active change requests retrieved from the database; and providing, by the processor, the active change requests from the response messages to the connectors to cause the connectors to translate the change requests into corresponding transaction and to perform the corresponding transactions with the endpoint computer systems to make the modifications to the access-control records of the endpoint computer systems, the method further comprising: periodically engaging, by the processor, in connector polling communications with the access management server, the access management server storing new connectors in the database to be sent to the fulfillment server for use thereby, the connector polling communications including request messages sent from the fulfillment server to the access management server and corresponding response messages sent from the access management server to the fulfillment server, the request messages requesting retrieval of new connectors from the database and the response messages containing new connectors retrieved from the database; and deploying, by the processor, the connectors received in the response messages for fulfilling change requests directed to associated ones of the endpoint computer systems, wherein creating a new connector includes configuring endpoint data to be used at runtime, in particular defining endpoint instances by specifying (i) a type of connector to use when talking to the endpoint instances; (ii) how to connect to the endpoint instances; (iii) which of a set of common commands an endpoint instance will support; and (iv) for each supported command, what information the endpoint instance will require as part of the command and how to implement the command, and wherein creating a new connector includes specifying capabilities and required parameters for using the connector, a capability being support for a particular command or operation with respect to one or more of a group, account, or role, and further including, for each capability, receiving a set of required parameters that must be supplied in a change request to exercise the capability.