Patent Description:
An enterprise directory holds information on the resources in an enterprise. These resources can include user, groups, and hardware. Users and organizations might employ a wide variety of commoditized enterprise tools and directories to assist them in their day-to-day work, such as communications, productivity, and file management software. These different tools do not communicate with each other and might be implemented differently. All require organization data to be input, requiring the customer to set up and manage their access and entitlement across multiple systems.

Managing multiple such tools requires regular manual updating of each system for routine organizational updates including, for example, creating new directory users when new employees are hired, removing users when employment ends, changing attributes (e.g., user name) on directory resources, and creating lists or groups of users in a directory.

<CIT> describes a system and method which propagates change operations to data items within a metadirectory on a differential basis in order to minimize or eliminate redundant updates to attributes within data items that have not changed, as well as conserve computing resources and transmission bandwidth consumed by update activities in large organizations of data items. A best match entry in the metadirectory is selected using a weighted score process, a determination is made as to exactly which attributes are changed by the update operation, and a differential update is propagated throughout the metadirectory via direct joiner access to the data items, or through remote access such as through LDAP.

<CIT> describes a method may include storing a first database including a first plurality of user identifiers (IDs) and corresponding privileges for accessing network resources associated with an organization. The method may also include storing a second database, different than the first database, including the first plurality of user IDs. The method may also include storing a third database, different than the first database and second database, including a second plurality user IDs associated with the organization. Further, the method may include removing, from the first database, privileges associated with user IDs appearing in the second database but not in the third database.

"Oracle Fusion Middleware - Administrator's Guide for Oracle Virtual Directory" provides information on how to utilize and administer Oracle Virtual Directory in an enterprise directory infrastructure.

<CIT> describes a lightweight directory access (LDAP) broker receives user information associated with a query for information in an LDAP repository. The query may be in an abstraction format. The LDAP broker determines a computing domain in view of the user information and retrieves a configuration file associated with the computing domain. The configuration file comprises a mapping for the query between an abstraction format and a vendor specific format. The LDAP broker converts the query to the vendor specific format in view of the mapping in the configuration file.

The invention is set out in the anexed claims.

The illustrative embodiments recognize and take into account one or more different considerations. For example, the illustrative embodiments recognize and take into account that organizations employing multiple external enterprise directories have to continually update and manage data across multiple systems which might be implemented differently and all require organization data. Such management across multiple systems is laborious and time consuming.

The illustrative embodiments further recognize and take into account that manually managing and updating decentralized data across multiple systems can result in data that is inconsistent and not synchronized across these systems.

The illustrative embodiments further recognize and take into account that time delays between employment termination and updating of directory user access creates potential securities risks to an organization.

Illustrative embodiments provide an interface that allows users to automatically synchronize updated user and organization data across multiple external systems using a singular point of access while maintaining authorization with those external systems.

With reference now to the figures and, in particular, with reference to <FIG>, an illustration of a diagram of a data processing environment is depicted in accordance with an illustrative embodiment. It should be appreciated that <FIG> is only provided as an illustration of one implementation and is not intended to imply any limitation with regard to the environments in which the different embodiments may be implemented. Many modifications to the depicted environments may be made.

The computer-readable program instructions may also be loaded onto a computer, a programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, a programmable apparatus, or other device to produce a computer implemented process, such that the instructions which execute on the computer, the programmable apparatus, or the other device implement the functions and/or acts specified in the flowchart and/or block diagram block or blocks.

<FIG> depicts a pictorial representation of a network of data processing systems in which illustrative embodiments may be implemented. Network data processing system <NUM> is a network of computers in which the illustrative embodiments may be implemented. Network data processing system <NUM> contains network <NUM>, which is a medium used to provide communications links between various devices and computers connected together within network data processing system <NUM>. Network <NUM> may include connections, such as wire, wireless communication links, or fiber optic cables.

In the depicted example, server computer <NUM> and server computer <NUM> connect to network <NUM> along with storage unit <NUM>. In addition, client computers include client computer <NUM>, client computer <NUM>, and client computer <NUM>. Client computer <NUM>, client computer <NUM>, and client computer <NUM> connect to network <NUM>. These connections can be wireless or wired connections depending on the implementation. Client computer <NUM>, client computer <NUM>, and client computer <NUM> may be, for example, personal computers or network computers. In the depicted example, server computer <NUM> provides information, such as boot files, operating system images, and applications to client computer <NUM>, client computer <NUM>, and client computer <NUM>. Client computer <NUM>, client computer <NUM>, and client computer <NUM> are clients to server computer <NUM> in this example. Network data processing system <NUM> may include additional server computers, client computers, and other devices not shown.

Program code located in network data processing system <NUM> may be stored on a computer-recordable storage medium and downloaded to a data processing system or other device for use. For example, the program code may be stored on a computer-recordable storage medium on server computer <NUM> and downloaded to client computer <NUM> over network <NUM> for use on client computer <NUM>.

In the depicted example, network data processing system <NUM> is the Internet with network <NUM> representing a worldwide collection of networks and gateways that use the Transmission Control Protocol/Internet Protocol (TCP/IP) suite of protocols to communicate with one another. At the heart of the Internet is a backbone of high-speed data communication lines between major nodes or host computers consisting of thousands of commercial, governmental, educational, and other computer systems that route data and messages. Of course, network data processing system <NUM> also may be implemented as a number of different types of networks, such as, for example, an intranet, a local area network (LAN), or a wide area network (WAN). <FIG> is intended as an example, and not as an architectural limitation for the different illustrative embodiments.

The illustration of network data processing system <NUM> is not meant to limit the manner in which other illustrative embodiments can be implemented. For example, other client computers may be used in addition to or in place of client computer <NUM>, client computer <NUM>, and client computer <NUM> as depicted in <FIG>. For example, client computer <NUM>, client computer <NUM>, and client computer <NUM> may include a tablet computer, a laptop computer, a bus with a vehicle computer, and other suitable types of clients.

In the illustrative examples, the hardware may take the form of a circuit system, an integrated circuit, an application-specific integrated circuit (ASIC), a programmable logic device, or some other suitable type of hardware configured to perform a number of operations. With a programmable logic device, the device may be configured to perform the number of operations. The device may be reconfigured at a later time or may be permanently configured to perform the number of operations. Programmable logic devices include, for example, a programmable logic array, programmable array logic, a field programmable logic array, a field programmable gate array, and other suitable hardware devices. Additionally, the processes may be implemented in organic components integrated with inorganic components and may be comprised entirely of organic components, excluding a human being. For example, the processes may be implemented as circuits in organic semiconductors.

Turning to <FIG>, a block diagram of a computer system for managing and synchronizing enterprise data across multiple external systems is depicted in accordance with an illustrative embodiment. System <NUM> comprises an internal system <NUM> such as, for example, a human resources (HR) database or similar platform. Through a lightweight directory access protocol (LDAP) interface <NUM>, the internal system <NUM> can populate, update, and synchronize enterprise data across multiple external systems <NUM>.

The internal system <NUM> can be an HR platform or database with its own communications protocol <NUM>. The internal system <NUM> can have multiple users <NUM> can be individuals or organizations. In an illustrative example, the user <NUM> among users <NUM> is an organization that has multiple employees <NUM>. Each employee <NUM> among employees <NUM> has a set of attributes <NUM>. These attributes can include personal identifying information as well as position and responsibilities within the user organization <NUM>, including access privileges to enterprises services such as external systems <NUM>.

Groups of employees within a user organization <NUM> can be organized into different teams <NUM>. Each team <NUM> within teams <NUM> has its own attributes <NUM>, which define the membership and function of the team within the organization including access privileges of the team to enterprise services such as external systems <NUM>. Access privileges to external systems listed in the attributes <NUM> of an employee can depend from the attributes <NUM> of a team <NUM> to which the employee belongs. Furthermore, an employee <NUM> might belong to multiple teams within team <NUM>.

The LDAP interface <NUM> provides a singular point of access for users <NUM> of internal system <NUM> to manage, update, and synchronize enterprise data across multiple external systems <NUM> through the Transmission Control Protocol/Internet Protocol (TCP/IP) protocol stack. LDAP <NUM> interface serves as a system of record data source.

LDAP is a request-response application protocol for accessing and maintaining distributed directory services. The LDAP interface <NUM> serves as a central repository for authorization attributes <NUM>, including usernames and passwords and other access credentials. LDAP interface <NUM> provides a protocol transition <NUM> between the protocol <NUM> of internal system <NUM> and protocol <NUM> of external system <NUM>, which might differ from the protocols from other systems among external systems <NUM>.

LDAP interface <NUM> acts as a layer over the internal HR system <NUM> that acts as a proxy for requests between the internal system <NUM> and external systems <NUM>. LDAP interface <NUM> presents data on the external systems <NUM> as close to the original as possible. By maintaining authorization attributes and credentials <NUM> on an on-demand basis, LDAP interface <NUM> enabling the HR system to be the source of truth for the external systems <NUM> and saving users <NUM> from having to continually log into the external systems <NUM> or being timed out of a session.

External systems <NUM> comprise third party enterprise directories providing a plurality of services to users <NUM>. External systems <NUM> can be heterogeneous directories, which can be implemented differently from each other. Each external system <NUM> within external systems <NUM> has unique functions <NUM>. Examples of functions <NUM> include communications (e.g., email and messaging), productivity, and file management. External system also has its own protocol, which can be different from protocols from the other external systems.

External system <NUM> includes users <NUM>. Users <NUM> can include individuals, organizations, or teams within organizations. User <NUM> among users <NUM> has data <NUM> stored on the external system <NUM>. User data <NUM> is maintained and synchronized across the external directories <NUM> according to business logic-specified directory tools associated with the external directories.

LDAP interface <NUM> maps users <NUM> listed in the external directories <NUM> to users <NUM> listed in the internal HR database <NUM>. LDAP interface <NUM> can also map employee groupings (teams) in the external directories <NUM> to teams <NUM> listed in the HR database <NUM>.

<FIG> is a block diagram of data synchronization between an internal platform and external enterprise system in accordance with an illustrative embodiment. This diagram illustrates how the LDAP interface handles the protocol transition between external and internal systems.

The internal HR system <NUM> connects to the LDAP Service <NUM> through TCP <NUM> and hypertext transfer protocol (HTTP) <NUM>. Representation state transfer/JavaScript Object Notation (REST/JSON) <NUM> provides stateless browser-to-server communications to provide interoperability between systems.

The LDAP service <NUM> uses the LDAP protocol <NUM> built on abstract syntax notation one (ASN. <NUM>) <NUM> to synchronize data received from internal HR system <NUM> with external system through TCP protocol <NUM>.

<FIG> depicts a process flow for synchronizing data across multiple external systems through a LDAP interface in accordance with an illustrative embodiment. Process <NUM> begins with an LDAP bind operation which authenticates the client system to the LDAP interface (step <NUM>). After successful authentication, the LDAP interface institutes throttling to limit how fast data will be transferred through the service, which prevents the service from using all available bandwidth (step <NUM>).

The interface then parses a request from the client and initiates an LDAP bind with the external directories (step <NUM>) and prepares the LDAP root directory (step <NUM>) to access the data cache <NUM> in an external directory. The LDAP interface submits an LDAP query to an external directory (step <NUM>).

In response to the LDAP query, the external directory searches for data in the data cache <NUM> (step <NUM>). If information from the client request is not found in the external direction, the external directory adds the missing data to the cache (step <NUM>) and prepares a response (step <NUM>). A reply is then sent to the LDAP interface denoting that the external directory has been updated in accordance with the client request (step <NUM>).

If there is no more new data to update and synchronize across the external directories, the LDAP interface unbinds from the client (step <NUM>), the process ends.

<FIG> illustrates a user interface for managing organizational units in accordance with an illustrative embodiment. Interface <NUM> includes a selector <NUM> that allows an administrator to select between displaying all members of an organization or just those from specific organizational units within the organization.

In the example shown in <FIG>, the administrator has selected all users within the organization. These users are displayed in a list <NUM> comprising user names and other identifying data within the organization. Next to each user is a selection box <NUM> that allows the administrator to select a user in question to add the user to a particular enterprise directory.

<FIG> illustrates a user interface for managing an individual user data in accordance with an illustrative embodiment. Interface <NUM> includes an identification field <NUM> listing the individual user in question. User information field <NUM> comprises detailed user information such as email, home address, employee identification, department, etc..

Resource usage field <NUM> show how much of directory resources available to the user have been used. Security field <NUM> indicates the security settings and policies that have been set for the user. Field <NUM> indicates which groups or teams with the organization to which the user belongs.

<FIG> illustrates a user interface for managing teams in accordance with an illustrative embodiment. Interface <NUM> displays a profile of a group or team identified in field <NUM>. All members assigned to the team are shown in list <NUM>. Next to each user is a selection box <NUM> that allows the administrator to select a team member to make a change such as, e.g., removing the member from the team, changing user security settings, etc..

Interface <NUM> and interface <NUM> allow an administrator to define a team comprising a subset of user profiles selected from the HR database and select a subset of external directories that are accessible by members of the team through the LDAP interface.

Turning now to <FIG>, an illustration of a block diagram of a data processing system is depicted in accordance with an illustrative embodiment. Data processing system <NUM> may be used to implement one or more computers and client computer system <NUM> in <FIG>. In this illustrative example, data processing system <NUM> includes communications framework <NUM>, which provides communications between processor unit <NUM>, memory <NUM>, persistent storage <NUM>, communications unit <NUM>, input/output unit <NUM>, and display <NUM>. In this example, communications framework <NUM> may take the form of a bus system.

Processor unit <NUM> serves to execute instructions for software that may be loaded into memory <NUM>. Processor unit <NUM> may be a number of processors, a multi-processor core, or some other type of processor, depending on the particular implementation. In an embodiment, processor unit <NUM> comprises one or more conventional general purpose central processing units (CPUs). In an alternate embodiment, processor unit <NUM> comprises one or more graphical processing units (GPUs).

Memory <NUM> and persistent storage <NUM> are examples of storage devices <NUM>. A storage device is any piece of hardware that is capable of storing information, such as, for example, without limitation, at least one of data, program code in functional form, or other suitable information either on a temporary basis, a permanent basis, or both on a temporary basis and a permanent basis. Storage devices <NUM> may also be referred to as computer-readable storage devices in these illustrative examples. Memory <NUM>, in these examples, may be, for example, a random access memory or any other suitable volatile or non-volatile storage device. Persistent storage <NUM> may take various forms, depending on the particular implementation.

For example, persistent storage <NUM> may contain one or more components or devices. For example, persistent storage <NUM> may be a hard drive, a flash memory, a rewritable optical disk, a rewritable magnetic tape, or some combination of the above. The media used by persistent storage <NUM> also may be removable. Communications unit <NUM>, in these illustrative examples, provides for communications with other data processing systems or devices. In these illustrative examples, communications unit <NUM> is a network interface card.

Input/output unit <NUM> allows for input and output of data with other devices that may be connected to data processing system <NUM>. For example, input/output unit <NUM> may provide a connection for user input through at least one of a keyboard, a mouse, or some other suitable input device. Further, input/output unit <NUM> may send output to a printer. Display <NUM> provides a mechanism to display information to a user.

Instructions for at least one of the operating system, applications, or programs may be located in storage devices <NUM>, which are in communication with processor unit <NUM> through communications framework <NUM>. The processes of the different embodiments may be performed by processor unit <NUM> using computer-implemented instructions, which may be located in a memory, such as memory <NUM>.

These instructions are referred to as program code, computer-usable program code, or computer-readable program code that may be read and executed by a processor in processor unit <NUM>. The program code in the different embodiments may be embodied on different physical or computer-readable storage media, such as memory <NUM> or persistent storage <NUM>.

Program code <NUM> is located in a functional form on computer-readable media <NUM> that is selectively removable and may be loaded onto or transferred to data processing system <NUM> for execution by processor unit <NUM>. Program code <NUM> and computer-readable media <NUM> form computer program product <NUM> in these illustrative examples. In one example, computer-readable media <NUM> may be computer-readable storage media <NUM> or computer-readable signal media <NUM>.

In these illustrative examples, computer-readable storage media <NUM> is a physical or tangible storage device used to store program code <NUM> rather than a medium that propagates or transmits program code <NUM>. Alternatively, program code <NUM> may be transferred to data processing system <NUM> using computer-readable signal media <NUM>.

Computer-readable signal media <NUM> may be, for example, a propagated data signal containing program code <NUM>. For example, computer-readable signal media <NUM> may be at least one of an electromagnetic signal, an optical signal, or any other suitable type of signal. These signals may be transmitted over at least one of communications links, such as wireless communications links, optical fiber cable, coaxial cable, a wire, or any other suitable type of communications link.

The different components illustrated for data processing system <NUM> are not meant to provide architectural limitations to the manner in which different embodiments may be implemented. The different illustrative embodiments may be implemented in a data processing system including components in addition to or in place of those illustrated for data processing system <NUM>. Other components shown in <FIG> can be varied from the illustrative examples shown. The different embodiments may be implemented using any hardware device or system capable of running program code <NUM>.

As used herein, the phrase "a number" means one or more. The phrase "at least one of", when used with a list of items, means different combinations of one or more of the listed items may be used, and only one of each item in the list may be needed. In other words, "at least one of" means any combination of items and number of items may be used from the list, but not all of the items in the list are required. The item may be a particular object, a thing, or a category.

For example, without limitation, "at least one of item A, item B, or item C" may include item A, item A and item B, or item C. Of course, any combinations of these items may be present. In some illustrative examples, "at least one of" may be, for example, without limitation, two of item A; one of item B; and ten of item C; four of item B and seven of item C; or other suitable combinations.

The flowcharts and block diagrams in the different depicted embodiments illustrate the architecture, functionality, and operation of some possible implementations of apparatuses and methods in an illustrative embodiment. In this regard, each block in the flowcharts or block diagrams may represent at least one of a module, a segment, a function, or a portion of an operation or step. For example, one or more of the blocks may be implemented as program code.

Claim 1:
A computer-implemented method for managing enterprise data, the method comprising:
creating, by a number of processors, a human resources, HR, database;
creating, by the number of processors, a lightweight directory access protocol, LDAP, interface in communication with the HR database and a number of third party heterogeneous external directories, wherein the HR database is the source of truth for the external directories,
wherein each external directory has a respective protocol that differs from protocols of other heterogenous external directories,
wherein the LDAP interface serves as a proxy for requests between the number of third party heterogenous external directories and the HR database,
wherein the LDAP interface maintains authorization credentials with the number of third party heterogenous external directories;
managing and synchronizing, by the number of processors, user data through the LDAP interface across the number of third party heterogeneous external directories using the LDAP protocol, wherein the LDAP interface:
authenticates a client system using an LDAP bind operation,
parses a request from the client,
initiates an LDAP bind operation with the number of third party heterogenous external directories,
prepares the LDAP root directory to access the data cache in one of the external directories,
submits an LDAP query to the external directory;
wherein the external directory, in response to said query, searches for client request data in the data cache and, if not found, adds the missing data to the data cache, and sends a response denoting that the external directory has been updated;
wherein the LDAP interface unbinds from the client when there is no more data to update and synchronize across the external directories.