Source: http://www.google.com/patents/US20100306376?ie=ISO-8859-1&dq=oakley+5,387,949
Timestamp: 2014-12-29 13:12:33
Document Index: 245972765

Matched Legal Cases: ['art 500', 'art 500', 'art 500', 'art 500', 'art 800', 'art 800', 'art 800', 'art 800', 'art 800', 'arts 1100', 'arts 1100', 'arts 1100', 'art 1100', 'arts 1100', 'art 500', 'art 800']

Patent US20100306376 - Managing user accounts and groups in multiple forests - Google PatentsSearch Images Maps Play YouTube News Gmail Drive More »Sign inAdvanced Patent SearchPatentsMethods, systems, and computer program products are provided for managing contact proxies and security proxies in networks that are organized as forests. For instance, contact proxies may be generated to represent user accounts and groups in forests other than the home forests of the user accounts and...http://www.google.com/patents/US20100306376?utm_source=gb-gplus-sharePatent US20100306376 - Managing user accounts and groups in multiple forestsAdvanced Patent SearchPublication numberUS20100306376 A1Publication typeApplicationApplication numberUS 12/473,113Publication dateDec 2, 2010Filing dateMay 27, 2009Priority dateMay 27, 2009Also published asUS7953896, US8095629, US20110196956Publication number12473113, 473113, US 2010/0306376 A1, US 2010/306376 A1, US 20100306376 A1, US 20100306376A1, US 2010306376 A1, US 2010306376A1, US-A1-20100306376, US-A1-2010306376, US2010/0306376A1, US2010/306376A1, US20100306376 A1, US20100306376A1, US2010306376 A1, US2010306376A1InventorsRobert D. Ward, Nima Ganjeh, Andreas B.G. KjellmanOriginal AssigneeMicrosoft CorporationExport CitationBiBTeX, EndNote, RefManClassifications (10), Legal Events (1) External Links: USPTO, USPTO Assignment, EspacenetManaging user accounts and groups in multiple forestsUS 20100306376 A1Abstract Methods, systems, and computer program products are provided for managing contact proxies and security proxies in networks that are organized as forests. For instance, contact proxies may be generated to represent user accounts and groups in forests other than the home forests of the user accounts and groups. Security proxy objects may be generated to represent group members (e.g., security principals and groups) in groups in forests other than the home forests of the group members. Furthermore, when both a contact object and a security proxy object exist for a member added to a group, one of the contact object or the security proxy object may be selected to represent the member in the group.
receiving an indication that an object is mail-enabled, the mail-enabled object being included in a first forest; determining one or more forests associated with the first forest; including the mail-enabled object in a contact set associated with each forest of the determined one or more forests; generating a contact object for the mail-enabled object; and including the contact object in a domain of each forest of the determined one or more forests. 2. The method of claim 1, wherein the mail-enabled object is a group or a user account.
3. The method of claim 1, wherein said determining one or more forests associated with the first forest comprises:
transmitting a request to the first forest for an indication of one or more forests associated with the first forest. 4. The method of claim 1, wherein said including the contact object in a domain of each forest of the determined one or more forests comprises:
transmitting the contact object to each forest of the determined one or more forests. 5. A computer-implemented method, comprising:
receiving an indication of a member added to a group, the group being included in a domain that is included in a first forest; determining whether the group is a cross-forest security group; determining whether a home forest of the added member is a forest that is trusted by the first forest; including the added member in a security proxy set associated with the domain if the group is determined to be a cross-forest security group and the home forest of the added member is determined to be a trusted forest of the first forest; generating a security proxy object for the added member; and including the security proxy object in the domain. 6. The method of claim 5, further comprising:
including the security proxy object as a member of the group. 7. The method of claim 5, further comprising:
determining whether the home forest of the added member is the first forest; and including the added member in the group if the home forest of the added member is determined to be the first forest. 8. The method of claim 5, wherein the member is a group or a security principal.
9. The method of claim 5, wherein said determining that the group is a cross-forest security group comprises:
determining that the group is a mail-enabled cross-forest security group. 10. The method of claim 5, wherein said determining whether a home forest of the added member is a forest that is trusted by the first forest comprises:
transmitting a request to the first forest for an indication of one or more forests trusted by the first forest. 11. The method of claim 5, wherein said including the security proxy object in the domain comprises:
transmitting to the first forest a group membership that includes the added member to request a security proxy object be generated and added to the domain. 12. A computer implemented method, comprising:
receiving an indication of a member added to a group, the group being included in a domain that is included in a first forest; determining that the added member is associated with a previously generated security proxy object and a previously generated contact object; determining whether the group is a cross-forest security group; determining whether a home forest of the added member is a forest that is trusted by the first forest; and including the security proxy object as a member of the group if the group is determined to be a cross-forest security group and the home forest of the added member is determined to be trusted by the first forest. 13. The method of claim 12, further comprising:
including the contact object as a member of the group if the group is determined to not be a cross-forest security group. 14. The method of claim 12, further comprising:
determining that the member is not to be included as a member of the group if the group is determined to be a cross-forest security group and the home forest of the added member is determined to not be trusted by the first forest. 15. The method of claim 12, wherein the member is a group or a security principal.
16. The method of claim 12, wherein said determining whether a home forest of the added member is a forest that is trusted by the first forest comprises:
transmitting a request to the first forest for an indication of one or more forests trusted by the first forest. 17. The method of claim 12, wherein said including the security proxy object as a member of the group if the group is determined to be a cross-forest security group and the home forest of the added member is determined to be trusted by the first forest comprises:
transmitting to the first forest a group membership that includes the added member to request a security proxy object be generated and added to the domain. 18. The method of claim 13, wherein said including the contact object as a member of the group if the group is determined to not be a cross-forest security group comprises:
transmitting the contact object to the first forest. Description
BACKGROUND Various services exist for managing computer networks. Such services may be configured to manage users and groups, and resources of the network that may be accessed by the users and groups. For example, Active Directory�, published by Microsoft Corporation of Redmond, Wash., is a directory service used to store information about the entities contained in a network. Active Directory� maintains a network structure as a hierarchical framework of objects. Several categories of objects exist in such a structure, including resources (e.g., printers, computers, etc.), services (e.g., email), and user-related objects such as user accounts and groups. The network structure provides various functions, including providing information on the objects, organizing the objects, controlling access, and setting security.
In another implementation, a method for generating security proxy objects is provided. An indication of a member added to a group is received. The group is in a domain that is in a first forest. Whether the group is a cross-forest security group is determined. Whether a home forest of the added member is a forest that is trusted by the first forest is also determined. The added member is included in a security proxy set associated with the domain if the group is determined to be a cross-forest security group and the home forest of the added member is determined to be a trusted forest of the first forest. A security proxy object for the added member is generated. The security proxy object is included in the domain and in the group.
II. Example Embodiments Embodiments relate to the management of security principals and groups in computer networks. Entities included in a computer network may be managed at various levels. For example, in one configuration, a highest level of management of entities of a network may be referred to as a �forest.� A forest includes all objects of a particular network, including all user accounts and groups of the network. A forest may include one or more domains. Each domain includes a portion of the objects included in the forest.
Multi-forest manager 302 and forest managers 408 a-408 c may be implemented in hardware, software, firmware, or any combination thereof For example, multi-forest manager 302 and/or forest managers 408 a-408 c may be implemented as computer program code configured to be executed in one or more processors. Alternatively, multi-forest manager 302 and/or forest managers 408 a-408 c may be implemented as hardware logic/electrical circuitry.
A. Example Embodiments for Generating Contacts Contacts may be generated for user accounts and groups in various ways. For example, FIG. 5 shows a flowchart 500 providing a process for generating contacts for user accounts and groups, according to an example embodiment. In an embodiment, flowchart 500 may be performed by multi-forest manager 302 shown in FIGS. 3 and 4. Multi-forest manager 302 may be configured in various ways to generate contacts for user accounts and groups. For instance, FIG. 6 shows a block diagram of a multi-forest manager 600, according to an example embodiment. Multi-forest manager 600 is an example of multi-forest manager 302. As shown in FIG. 6, multi-forest manager 600 includes a user interface 604, an associated forest list requester 606, a contact set modifier 608, and a contact object generator 610. Flowchart 500 is described as follows with respect to multi-forest manager 600 for illustrative purposes. Other structural and operational embodiments will be apparent to persons skilled in the relevant art(s) based on the discussion regarding flowchart 500 and multi-forest manager 600.
B. Example Embodiments for Generating Security Proxies In embodiments, security proxies may be generated for security principals (e.g., objects that may be security-enabled, including user accounts, computer objects, etc.) and groups in various ways. For example, FIG. 8 shows a flowchart 800 providing a process for generating security proxies for security principals and groups, according to an example embodiment. In an embodiment, flowchart 800 may be performed by multi-forest manager 302 shown in FIGS. 3 and 4. Multi-forest manager 302 may be configured in various ways to generate security proxies for security principals and groups. For instance, FIG. 9 shows a block diagram of a multi-forest manager 900, according to an example embodiment. Multi-forest manager 900 is an example of multi-forest manager 302. As shown in FIG. 9, multi-forest manager 600 includes user interface 604, group type determiner 904, trusted home forest determiner 906, security proxy set modifier 908, and a security proxy object generator 910. Flowchart 800 is described as follows with respect to multi-forest manager 900 for illustrative purposes. The steps of flowchart 800 do not necessarily need to be performed in the order shown. Other structural and operational embodiments will be apparent to persons skilled in the relevant art(s) based on the discussion regarding flowchart 800 and multi-forest manager 900.
In step 804, whether the group is a cross-forest security group is determined. For example, in an embodiment, group type determiner 904 may be configured to determine whether the group to which the member was added is a cross-forest security group. A security group is a type of group that enables members of the group to access resources associated with the group (�resources secured by the group�) (e.g., access to particular records, computers, etc.). Access to resources associated with a security group is limited to members of the security group. A cross-forest security group is a security group that is configured to enable access to resources to members that are from multiple designated forests.
In step 806, whether a home forest of the added member is a trusted forest of the first forest is determined. For example, in an embodiment, trusted home forest determiner 906 may be configured to determine whether a home forest of the added member is a trusted forest of the forest of the group to which the member was added. A trusted forest of a first forest is a forest that allows members of security groups of the first forest to access resources in the trusted forest that are secured by the security group. For example, referring to FIG. 1, second forest 102 bmay be a trusted forest of first forest 102 a. As such, members of cross-forest security groups having first forest 102 a as a home forest may be enabled to access resources of second forest 102 b that are secured by the security group.
C. Example Embodiments for Selecting Contacts or Security Proxies As described above, contact proxies and security proxies may be generated for user accounts, security principals, and groups in various ways. In some situations, both a contact proxy and a security proxy may be generated for a group member. In such case, it may be desirable to select one of the contact proxy or security proxy, so that a single representative for the group member is present in the group. Such selection of a proxy may be performed in various ways. For example, FIGS. 11 and 12 show flowcharts 1100 and 1200 providing processes for selecting a contact proxy or a security proxy for membership in a group, according to example embodiments. In an embodiment, flowcharts 1100 and 1200 may be performed by multi-forest manager 302 shown in FIGS. 3 and 4. Multi-forest manager 302 may be configured in various ways to select a proxy for a group. For instance, FIG. 13 shows a block diagram of a multi-forest manager 1300, according to an example embodiment. Multi-forest manager 1300 is an example of multi-forest manager 302. As shown in FIG. 13, multi-forest manager 1300 includes user interface 604, a previously generated proxy object detector 1302, and a group modifier 1304. Flowcharts 1100 and 1200 are described as follows with respect to multi-forest manager 1300 for illustrative purposes. The steps of flowchart 1100 and 1200 do not necessarily need to be performed in the orders shown. Other structural and operational embodiments will be apparent to persons skilled in the relevant art(s) based on the discussion regarding flowcharts 1100 and 1200, and multi-forest manager 1300.
In step 1104, whether the added member is associated with a previously generated security proxy object and a previously generated contact object is determined. For example, in an embodiment, previously generated proxy object detector 1302 may determine whether a security proxy object and a contact object were previously generated for the added member. For example, in an embodiment, previously generated proxy object detector 1302 may be configured to access storage 602 for proxy objects 1316. Proxy objects 1316 is a data structure that includes any contact objects (e.g., contact objects 626 of FIG. 6) and security proxy objects (e.g., security proxy objects 924 of FIG. 9) that have previously been generated. For example, contact objects may be included in proxy objects 1316 that were previously generated according to flowchart 500 (FIG. 5) or in another manner. Security proxy objects may be included in proxy objects 1316 that were previously generated according to flowchart 800 (FIG. 8) or in another manner.
III Further Example Embodiments FIG. 15 depicts an exemplary implementation of a computer 1500 in which embodiments of the present invention may be implemented. For instance, computer system 402 and computer systems 406 a-406 c shown in FIG. 4 may be implemented similarly to computer 1500, and may include one or more features of computer 1500 and/or alternative features. Computer 1500 may be a general-purpose computing device in the form of a conventional personal computer, a mobile computer, or a workstation, for example, or computer 1500 may be a special purpose computing device. The description of computer 1500 provided herein is provided for purposes of illustration, and is not intended to be limiting. Embodiments of the present invention may be implemented in further types of computer systems, as would be known to persons skilled in the relevant art(s).
Classifications U.S. Classification709/225, 709/206, 726/27International ClassificationG06F15/16, G06F7/04, G06F15/173Cooperative ClassificationG06Q10/06, H04L63/104European ClassificationG06Q10/06, H04L63/10CLegal EventsDateCodeEventDescriptionJul 31, 2009ASAssignmentOwner name: MICROSOFT CORPORATION, WASHINGTONFree format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:WARD, ROBERT D.;GANJEH, NIMA;KJELLMAN, ANDREAS B.G.;REEL/FRAME:023034/0018Effective date: 20090521RotateOriginal ImageGoogle Home - Sitemap - USPTO Bulk Downloads - Privacy Policy - Terms of Service - About Google Patents - Send FeedbackData provided by IFI CLAIMS Patent Services©2012 Google