Patent ID: 9736159
Date: 2017-08-15
CPC Classifications: G06F,H04L

Claim:
1. A computer-implemented method, comprising: under the control of one or more computer systems configured with executable instructions, enabling a user to utilize a set of credentials to access an interface provided by a computing resource service provider to access a managed directory service; receiving, at the computing resource service provider, a request from the user to create an identity pool within the managed directory service of the computing resource service provider, the first request comprising information based at least in part on the set of credentials and the identity pool comprising user profiles of one or more other users of the managed directory service and directory policies defining, for each user of the one or more other users, a level of access to a directory within the managed directory service and to applications managed in the directory; creating, at the managed directory service, the identity pool and a shadow administrative account within the identity pool, the shadow administrative account usable for managing the user profiles of the one or more other users of the managed directory service and the directory policies for defining the level of access to the directory and to the applications managed in the directory for individual users of the directory; transmitting, through the computing resource service provider and to the managed directory service, an application programming interface command from the user to obtain a directory token for accessing the shadow administrative account, the application programming interface command made available to the user by the managed directory service; receiving the directory token from the managed directory service; and enabling the user to utilize the received directory token to perform actions within the directory.